T09 · Insecure Skill Coding Practices
Error
- Location
scripts/diagnosis_review.py:246- Finding
Caller-Controlled LLM Endpoint Can Receive Medical Records and Bearer Credentials
- Content
View full analysis
str: selected_model = model_name or self._settings.default_model model_config = self._settings.models.get(selected_model) if model_config is None: raise ValueError(f"未找到模型配置: {selected_model}") payload = { "model": model_config.model_id or selected_model, "messages": [{"role": "user", "content": prompt}], "temperature": model_config.temperature, } if model_config.type == "openai_compatible": return self._post_chat( url=f"{model_config.base_url.rstrip('/')}/chat/completions", payload=payload, headers={"Authorization": f"Bearer {model_config.api_key}"}, ) raise ValueError(f"不支持的模型类型: {model_config.type}") def _post_chat(self, url: str, payload: dict[str, Any], headers: dict[str, str]) -> str: body = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = request.Request( url=url, data=body, headers={"Content-Type": "application/json", **{key: value for key, value in headers.items() if value}}, method="POST", ) opener = request.urlopen(req) if not self._settings.timeout else request.urlopen(req, timeout=self._settings.timeout) with opener as response: response_payload = json.loads(response.read().decode("utf-8")) ``` The endpoint and credential are populated from the request payload: ```python def _load_llm_client(use_llm: bool, appkey: str, base: str = DEFAULT_LLM_BASE, model: st ...[truncated 3384 chars]- Remediation
View remediation