T09 · Insecure Skill Coding Practices
Error
- Location
scripts/image_generate.py:188- Finding
Unrestricted DashScope Endpoint Override Can Expose API Credentials and User Content
- Content
View full analysis
str: return _get_value("DASHSCOPE_BASE_URL", env_path) or DEFAULT_BASE_URL ``` ```python # scripts/image_generate.py response = dashscope.MultiModalConversation.call( api_key=get_dashscope_key(env_path=env_path), model=model, messages=messages, result_format="message", stream=False, watermark=False, prompt_extend=True, negative_prompt=negative_prompt or DEFAULT_NEGATIVE_PROMPT, size=build_size(width, height), ) parser.add_argument( "--base-url", default=None, help="Override DashScope base URL", ) dashscope.base_http_api_url = ( args.base_url or get_region_base_url(env_path=args.config) ) ``` ```python # scripts/ocr_text.py resp = dashscope.MultiModalConversation.call( api_key=get_dashscope_key(), model=model, messages=messages, ocr_options={"task": "text_recognition"}, ) parser.add_argument("--base-url", default=None) if args.base_url: dashscope.base_http_api_url = args.base_url else: dashscope.base_http_api_url = get_region_base_url() ``` ```python # scripts/tts_speak.py resp = dashscope.audio.qwen_tts.SpeechSynthesizer.call( api_key=get_dashscope_key(), **kwargs, ) parser.add_argument("--base-url", default=None) if args.base_url: dashscope.base_http_api_url = args.base_url else: dashscope.base_http_api_url = get_region_base_url() ``` ### Technical Analysis The three service clients permit the DashScope base URL to be supplied through either a command-line argument or the `DASHSCOPE_BASE_URL` configuration value. The supplied URL is assign ...[truncated 1965 chars]- Remediation
View remediation