T09 · Insecure Skill Coding Practices
- Location
scripts/videogen.py:67- Finding
Unvalidated API Base URL Can Expose the API Key and Uploaded Media
- Content
View full analysis
Vulnerability Details
File Location:
scripts/videogen.py:67-76,scripts/videogen.py:105-115, andscripts/videogen.py:128-130
Vulnerability Type: User-controlled credential destination
Risk Level: HighVulnerable Code
python def _resolve_base_url(self, cli_url): if cli_url: return cli_url.rstrip("/") env_url = os.environ.get("AI_HIVE_BASE_URL") if env_url: return env_url.rstrip("/") file_config = self._read_config_file() if file_config.get("base_url"): return file_config["base_url"].rstrip("/") return DEFAULT_BASE_URLpython def __init__(self, config): self.config = config self.base = config.base_url self.headers = { "Authorization": f"Bearer {config.api_key}", "Content-Type": "application/json", } def _url(self, path): return f"{self.base}/openapi/v1/{path}"python resp = requests.request( method, url, headers=self.headers, timeout=DEFAULT_TIMEOUT, **kwargs )Technical Analysis
The API base URL can be supplied through the
--base-urlcommand-line option, theAI_HIVE_BASE_URLenvironment variable, or the local configuration file. The value is only normalized by removing trailing slashes. The application does not enforce HTTPS, validate the hostname, reject embedded credentials or unexpected ports, or restrict the destination to the documented AI Hive service.AiHiveClientsubsequently adds the user's AI Hive API key to theAuthorizationheader of every API request. Therefore, any party that can influence the base URL can redirect authenticated requests to a server under its control.This issue also affects media confidentiality. A malicious replacement server can respond to the upload-token request with an attacker-controlled object-storage URL. The upload code will then transfer the user-selected media to that URL using the method and heade ...[truncated 2047 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove runtime base URL overrides if alternate endpoints are not an operational requirement.
- If overrides are required, parse the URL with
urllib.parse.urlsplitand enforce:- The
httpsscheme; - An explicit allowlist of approved hostnames, such as
ai-hive.iclip.cn; - Approved ports only;
- No embedded username or password;
- No fragments or ambiguous hostname representations.
- The
- Resolve and validate the final URL before attaching the
Authorizationheader. Credentials should only be sent to explicitly trusted origins. - Maintain separate authenticated and unauthenticated HTTP clients so API credentials cannot accidentally be attached to object-storage or other third-party requests.
- Validate upload-token responses before transferring user media. Restrict upload schemes to HTTPS and, where possible, allowlist the approved object-storage domains.
- If custom enterprise endpoints must be supported, require explicit user confirmation before sending credentials or media to a non-default origin. Display the normalized destination hostname in that confirmation.
- Consider ignoring
AI_HIVE_BASE_URLin untrusted automation contexts, or require a dedicated opt-in flag before environment-based endpoint overrides are accepted. - Add automated tests confirming that HTTP URLs, embedded credentials, deceptive subdomains, unapproved hosts, and unexpected ports are rejected before any authenticated request is issued.