T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/transcribe.py:23- Finding
Arbitrary Local File Upload to an Unrestricted Remote Endpoint
- Content
View full analysis
str: boundary = "----OpenClawBoundary" + uuid.uuid4().hex mime = mimetypes.guess_type(str(path))[0] or "application/octet-stream" body = [] body.append(f"--{boundary}\r\n".encode()) body.append( f'Content-Disposition: form-data; name="files"; filename="{path.name}"\r\n'.encode() ) body.append(f"Content-Type: {mime}\r\n\r\n".encode()) body.append(path.read_bytes()) body.append(f"\r\n--{boundary}--\r\n".encode()) data = b"".join(body) req = request.Request( f"{space}/gradio_api/upload", data=data, method="POST", headers={ "Content-Type": f"multipart/form-data; boundary={boundary}", "User-Agent": USER_AGENT, }, ) with request.urlopen(req, timeout=300) as resp: uploaded = json.loads(resp.read().decode("utf-8")) ``` ```python def transcribe_file(path: Path, space: str, task: str) -> str: if not path.exists(): raise FileNotFoundError(path) mime = mimetypes.guess_type(str(path))[0] or "application/octet-stream" server_path = upload_file(space, path) event_id = submit_job(space, server_path, path.name, mime, task) return wait_for_result(space, event_id) ``` ```python parser.add_argument("input", help="Path to local audio file") parser.add_argument("--task", choices=["transcribe", "translate"], default="transcribe") parser.add_argument("--space", default=DEFAULT_SPACE, help="Base URL of the Gradio space") parser.add_argument("--format", choices=["auto", "raw", "zh"], default="auto", help="Post-process transcript punctuation") parser.add_argument("--json", action="store_tru ...[truncated 2846 chars]- Remediation
View remediation