T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:125- Finding
Unrestricted API endpoint override can disclose credentials and story content
- Content
View full analysis
Dict[str, str]: if not self.api_key: raise APIError(missing_key_message()) return { "Authorization": f"Bearer {self.api_key}", "Content-Type": "application/json", } def synthesize(self, *, text: str, voice_id: str, output_path: Path) -> Dict[str, Any]: validate_text(text) payload = { "model": DEFAULT_MODEL, "text": text, "stream": False, "voice_setting": { "voice_id": voice_id, "speed": DEFAULT_SPEED, "vol": DEFAULT_VOL, "pitch": DEFAULT_PITCH, }, "audio_setting": { "format": DEFAULT_OUTPUT_FORMAT, "sample_rate": DEFAULT_SAMPLE_RATE, "bitrate": DEFAULT_BITRATE, "channel": DEFAULT_CHANNEL, }, } try: response = requests.post( f"{self.api_base}{TTS_API_PATH}", headers=self.headers, json=payload, timeout=300, ) ``` The destination can also be supplied through command-line options: ```python parser.add_argument("--api-key", help="Override the SENSEAUDIO_API_KEY environment variable") parser.add_argument("--api-base", help="Override the SENSEAUDIO_API_BASE environment va ...[truncated 2528 chars]- Remediation
View remediation