other
Error
- Location
scripts/run.py:15- Finding
Mandatory Disclosure of Sensitive Health Records to an External API
- Content
View full analysis
Vulnerability Details
File Location:
scripts/run.py, lines 15, 31-48, and 153-164
Vulnerability Type: Sensitive health data disclosure
Risk Level: HighVulnerable Code
python API_URL = "https://maas-api.hivoice.cn/v1/chat/completions" MODEL = "u2-med"python def _call_llm(system_prompt: str, user_prompt: str, appkey: str) -> str: payload = { "model": MODEL, "temperature": 0.0, "messages": [ {"role": "system", "content": system_prompt}, {"role": "user", "content": user_prompt}, ], } try: req = Request(API_URL, data=json.dumps(payload, ensure_ascii=False).encode("utf-8"), headers={"Content-Type": "application/json", "Authorization": f"Bearer {appkey}"}) resp = urlopen(req, timeout=120) body = json.loads(resp.read().decode("utf-8")) except HTTPError as exc: detail = exc.read().decode("utf-8", errors="replace")[:500] raise RuntimeError(f"API HTTP {exc.code}: {detail}") except URLError as exc: raise RuntimeError(f"API unreachable: {exc.reason}") if "choices" not in body or not body["choices"]: raise RuntimeError("API response missing choices") return body["choices"][0].get("message", {}).get("content", "")python def build(data: Dict[str, Any], appkey: str) -> Dict[str, Any]: # 1. Local preprocessing: normalize record list raw = data if isinstance(data, list) else [data] records = _local_normalize(raw) # 2. Validate required fields for i, rec in enumerate(records): require(rec, "value") # 3. Construct user prompt user_prompt = f"Please analyze the following blood glucose monitoring data:\n```json\n{json.dumps(records, ensure_ascii=False, indent=2)}\n```" # 4. Call API text = _call_llm(SYSTEM_PROMPT, us ...[truncated 1826 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user consent before transmitting health records.
- Clearly identify the external processor and disclose its retention, training, and secondary-use policies.
- Minimize transmitted data by omitting timestamps and notes unless they are necessary for the requested analysis.
- Redact names, patient identifiers, contact details, and other identifying information before creating the prompt.
- Add a local-only mode that produces structured records without invoking the external API.
- Provide a preview of the exact payload and destination before transmission.
- Establish appropriate encryption, data-processing, retention, deletion, and audit controls for sensitive medical information.