T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/main.py:96
- Finding
- Arbitrary API endpoint can receive the bearer token and sensitive academic content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:96-100`, `scripts/main.py:157-164`, `scripts/main.py:209-215`, `scripts/main.py:540-541` **Vulnerability Type**: Unrestricted sensitive-data transmission to a configurable network endpoint **Risk Level**: High ### Vulnerable Code ```python class SenseAudioClient: def __init__(self, api_key: Optional[str] = None, api_base: Optional[str] = None): self.api_key = (api_key or os.getenv("SENSEAUDIO_API_KEY", "")).strip() self.api_base = (api_base or os.getenv("SENSEAUDIO_API_BASE", DEFAULT_API_BASE)).rstrip("/") ``` ```python with audio_path.open("rb") as audio_file: files = {"file": (audio_path.name, audio_file, guess_mime_type(audio_path))} response = requests.post( f"{self.api_base}{ASR_API_PATH}", headers=self.headers_auth_only, data=data, files=files, timeout=600, ) ``` ```python response = requests.post( f"{self.api_base}{TTS_API_PATH}", headers=self.headers_json, json=payload, timeout=300, ) ``` ```python parser.add_argument("--api-key", help="Override the API key from the environment") parser.add_argument("--api-base", help="Override the API base from the environment") ``` ### Technical Analysis The client obtains its API destination from either the `--api-base` command-line argument or the `SENSEAUDIO_API_BASE` environment variable. The value is only normalized by removing trailing slashes. It is not restricted to HTTPS and is not checked against the official SenseAudio hostname. Both network operations attach the SenseAudio bearer token to requests sent to this configurable destination: - The ASR operation transmits the authorization token and the complete user-selected recording. - The TTS operation transmits the authorization token and the complete summary text. - An HTTP endpoint would expose these values to network interception. - An attacker-controlled HTTPS endpoint would receive them d ...[truncated 1562 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict the default destination to the documented official endpoint: - Scheme: `https` - Hostname: `api.senseaudio.cn` - Expected port: `443` 2. Parse the destination with `urllib.parse.urlparse` and reject: - Plain HTTP URLs. - URLs containing user information. - Unexpected ports. - Unapproved hostnames. - Malformed URLs or URL fragments. 3. Do not attach the authorization header until the parsed destination has passed validation. 4. If private or enterprise endpoints must be supported, use an explicit administrator-managed hostname allowlist rather than accepting arbitrary user input. 5. Consider removing `--api-base` from ordinary user-facing commands. Place alternate endpoint configuration in trusted deployment configuration instead. 6. Add clear consent messaging before uploading recordings, stating that audio and summary text will be transferred to SenseAudio. 7. Add automated tests proving that HTTP, loopback, link-local, private-network, and unapproved public destinations are rejected. 8. Ensure error messages and diagnostic logs never include bearer tokens or full sensitive payloads. ]]>