T09 · Insecure Skill Coding Practices
Error
- Location
- lux3d_client.py:90
- Finding
- Lux3D API Key Disclosure Through an Unrestricted Base URL Override<![CDATA[ ## Vulnerability Details **File Location**: `lux3d_client.py:90-109`, `lux3d_client.py:332-336`, `lux3d_client.py:387-392`, `lux3d_client.py:1047-1052` **Vulnerability Type**: Arbitrary authenticated API endpoint configuration **Risk Level**: High ### Vulnerable Code ```python def get_base_url(region=None): """Return the configured Lux3D API root.""" configured = os.environ.get("LUX3D_BASE_URL", "").strip() if configured: return normalize_base_url(configured, region) return REGION_BASE_URLS[normalize_region(region)] def normalize_base_url(base_url=None, region=None): """Normalize a custom base URL to the documented Lux3D API root.""" if not base_url: base_url = os.environ.get("LUX3D_BASE_URL", "").strip() if not base_url: return REGION_BASE_URLS[normalize_region(region)] normalized = str(base_url).strip().rstrip("/") if normalized == "https://api.aholo3d.com": return INTERNATIONAL_BASE_URL if normalized == CN_BASE_URL: return CN_BASE_URL return normalized ``` ```python def get_auth_headers(): """Build the Lux3D authentication headers.""" return { "Content-Type": "application/json", "Authorization": validate_api_key(), } ``` ```python def submit_task(path, payload, base_url=None, region=None): """Submit an asynchronous task and return its task ID.""" url = normalize_base_url(base_url, region) + path response = secure_request( "POST", url, headers=get_auth_headers(), data=payload ) ``` ```python parser.add_argument( "--base-url", default=None, help="Override the API root; LUX3D_BASE_URL is also supported.", ) ``` ### Technical Analysis The client permits the API root to be overridden through the `--base-url` command-line option, the `base_url` function argument, or the `LUX3D_BASE_URL` environment variable. `normalize_base_url()` does not validate the URL scheme or restrict the destination to ...[truncated 1910 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove arbitrary base URL overrides if they are not essential. 2. If overrides are required, allowlist exact approved origins, such as: - `https://api.aholo3d.com/global` - `https://api.aholo3d.cn` 3. Require HTTPS and reject URLs containing user information, fragments, unexpected ports, or unapproved hosts. 4. Compare parsed origins rather than performing string-prefix checks. 5. Construct authenticated request URLs only from trusted constants selected through the validated region setting. 6. Add a final origin check immediately before attaching the `Authorization` header. 7. Separate authenticated and unauthenticated request functions so credentials cannot be sent to arbitrary artifact or custom endpoints. 8. Add tests confirming that HTTP URLs, localhost, private IP addresses, lookalike domains, subdomains, and arbitrary external hosts are rejected. 9. Rotate any API key that may previously have been used with an untrusted `--base-url` or `LUX3D_BASE_URL` value. ]]>