T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/seedance_pipeline.py:47
- Finding
- Bearer Credential Disclosure Through an Unrestricted API Base URL<![CDATA[ ## Vulnerability Details **File Location**: `scripts/seedance_pipeline.py:47-62` and `scripts/seedance_pipeline.py:286-289` **Vulnerability Type**: Unvalidated credential-bearing network destination **Risk Level**: High ### Vulnerable Code ```python class ArkClient: def __init__(self, key: str, base_url: str) -> None: self.key = key self.base_url = base_url.rstrip("/") def request(self, method: str, path: str, payload: dict[str, Any] | None = None) -> dict[str, Any]: body = None if payload is None else json.dumps(payload).encode("utf-8") request = Request( f"{self.base_url}{path}", data=body, method=method, headers={ "Authorization": f"Bearer {self.key}", "Content-Type": "application/json", "User-Agent": "sn-motion-html/1.0", }, ) ``` ```python key = os.getenv("ARK_API_KEY") or os.getenv("VOLCENGINE_API_KEY") if not key: raise SystemExit("ARK_API_KEY is not set in the project-local .env file") client = ArkClient(key, os.getenv("ARK_BASE_URL", "https://ark.cn-beijing.volces.com/api/v3")) ``` ### Technical Analysis The API destination is taken directly from the `ARK_BASE_URL` environment variable. The value is not restricted to HTTPS, compared against an allowlist, or otherwise verified as an official Volcengine Ark endpoint. The client subsequently attaches the user's Ark bearer credential to every request sent to this destination. Generation requests also contain the text prompt and Base64-encoded conditioning images. Consequently, a modified project-local `.env` file can redirect credential-bearing requests to an arbitrary server. Supporting a configurable provider endpoint can be legitimate, but automatically transmitting a production credential to any configured origin exceeds the minimum privilege needed for the declared Seedance integration. The default endpoint is legitimate; the ...[truncated 1463 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict the default client to an explicit allowlist of official Ark hosts: ```python from urllib.parse import urlsplit OFFICIAL_ARK_HOSTS = {"ark.cn-beijing.volces.com"} def validate_base_url(value: str) -> str: parsed = urlsplit(value) if parsed.scheme != "https": raise ValueError("ARK_BASE_URL must use HTTPS") if parsed.hostname not in OFFICIAL_ARK_HOSTS: raise ValueError("ARK_BASE_URL is not an approved Ark endpoint") if parsed.username or parsed.password or parsed.fragment: raise ValueError("ARK_BASE_URL contains unsupported URL components") return value.rstrip("/") ``` 2. Do not attach an Ark credential to an untrusted origin. If custom enterprise endpoints are required, maintain a separately configured allowlist rather than accepting arbitrary origins. 3. Require explicit user confirmation before the first request to any non-default endpoint, clearly displaying the scheme and hostname without displaying the credential. 4. Reject plaintext HTTP endpoints. 5. Avoid loading provider destination settings from untrusted project content when a trusted installation-level configuration is available. 6. Add tests proving that HTTP URLs, user-info URLs, lookalike domains, redirect-based destination changes, and unapproved hosts are rejected. 7. Consider disabling automatic redirects for credential-bearing requests or verify that redirects remain on the approved HTTPS origin before resending authorization headers. ]]>