T09 · Insecure Skill Coding Practices
Warning
- Location
assets/akshare-workbench/backend/app/services/ai_config.py:49- Finding
AI API Credentials Are Stored in Plaintext and May Be Forwarded to an Untrusted or Cleartext Endpoint
- Content
View full analysis
AIConfig: config = AIConfig( base_url=base_url.strip(), model=model.strip(), api_key=api_key.strip(), ) with _lock: _CONFIG_DIR.mkdir(parents=True, exist_ok=True) with _CONFIG_PATH.open("w", encoding="utf-8") as fh: json.dump( { "base_url": config.base_url, "model": config.model, "api_key": config.api_key, }, fh, ensure_ascii=False, indent=2, ) return config ``` The configuration API accepts any nonempty Base URL and persists it together with the API key. It does not require HTTPS, restrict the destination host, or explicitly confirm custom endpoints: ```python @router.put("/ai/config", response_model=AIConfigPublic) def update_ai_config(payload: AIConfigUpdate) -> AIConfigPublic: from app.services.ai_config import load_config, save_config if not payload.base_url.strip() or not payload.model.strip(): raise HTTPException( status_code=status.HTTP_422_UNPROCESSABLE_ENTITY, detail="base_url 与 model 不能为空。", ) api_key = payload.api_key.strip() if not api_key: existing = load_config() if existing is None: raise HTTPExcept ...[truncated 5337 chars]- Remediation
View remediation