T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lens_search.py:40- Finding
Automatic Disclosure of Local Files to Third-Party Image Hosting Services
- Content
View full analysis
str: """Resolve image input to a public URL for SerpAPI. - URLs are returned as-is. - Local files are uploaded to a free image host. """ if image_path.startswith(("http://", "https://")): return image_path if not os.path.exists(image_path): print(f"Error: File not found: {image_path}", file=sys.stderr) sys.exit(1) file_size = os.path.getsize(image_path) if file_size > MAX_UPLOAD_BYTES: print(f"Error: File too large ({file_size / 1024 / 1024:.1f}MB > {MAX_UPLOAD_BYTES / 1024 / 1024:.0f}MB limit)", file=sys.stderr) sys.exit(1) # Prefer imgbb if key is available, otherwise freeimage.host imgbb_key = os.environ.get("IMGBB_API_KEY", "") if imgbb_key: url = _upload_imgbb(image_path, imgbb_key) if url: return url url = _upload_freeimage(image_path) if url: return url print("Error: Cannot upload local image. Provide an image URL or set IMGBB_API_KEY.", file=sys.stderr) sys.exit(1) def _read_as_base64(path: str) -> str: with open(path, "rb") as f: return base64.b64encode(f.read()).decode() def _upload_freeimage(image_path: str) -> str | None: """Upload to freeimage.host (free, no API key required).""" data = urllib.parse.urlencode({ "key": "6d207e02198a847aa98d0a2a901485a5", # freeimage public API key "action": "upload", "source": _read_as_base64(image_path), "format": "json", }).encode() req = urllib.request.Request("https://freeimage.host/api/1/upload", data=data) try: with urllib.request.urlopen(req, timeout=30 ...[truncated 4683 chars]- Remediation
View remediation