T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gen.py:29- Finding
OpenAI API Credential Can Be Sent to an Arbitrary Environment-Controlled Endpoint
- Content
View full analysis
str: base = ( os.environ.get("OPENAI_BASE_URL") or os.environ.get("OPENAI_API_BASE") or "https://api.openai.com" ).rstrip("/") if base.endswith("/v1"): return f"{base}/images/generations" return f"{base}/v1/images/generations" ``` The selected API key is placed in an authorization header without validating the destination: ```python def _post_json(url: str, api_key: str, payload: dict, timeout_s: int) -> dict: body = json.dumps(payload).encode("utf-8") req = urllib.request.Request( url, data=body, headers={ "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", }, method="POST", ) try: with urllib.request.urlopen(req, timeout=timeout_s) as resp: raw = resp.read() ``` The environment-derived URL and API key are then used together: ```python api_key = args.api_key or os.environ.get("OPENAI_API_KEY") if not api_key: print("missing OPENAI_API_KEY (or --api-key)", file=sys.stderr) return 2 # ... url = _api_url() items: list[dict] = [] for i, prompt in enumerate(prompts, 1): payload = { "model": args.model, "prompt": prompt, "size": args.size, "quality": args.quality, "n": 1, "response_format": "b64_json", } data = _post_json(url=url, api_key=api_key, payload=payload, timeout_s=args.timeout) ``` ### Technical Analysis The script accepts `OPENAI_BASE_URL` and `OPENAI_API_BASE` as authoritative network destinations. It does not validate that the resulting URL: - Uses HTTPS. - Resolves to ...[truncated 2097 chars]- Remediation
View remediation