T09 · Insecure Skill Coding Practices
Error
- Location
tts_client.py:67- Finding
Authentication Credentials and User Text Can Be Sent to an Untrusted Configurable Endpoint
- Content
View full analysis
Dict[str, str]: """Build request headers.""" headers = { "Content-Type": "application/json", "X-Api-App-Id": self.app_id, "X-Api-Access-Key": self.access_token, "X-Api-Resource-Id": self.resource_id, # Add Authorization header because some API nodes require it "Authorization": f"Bearer; {self.access_token}", } if request_id: headers["X-Api-Request-Id"] = request_id return headers ``` ```python response = SeedTTS2._session.post( self.api_url, headers=headers, json=payload, stream=True, timeout=self.timeout ) ``` ### Technical Analysis The API destination can be supplied through the `api_url` constructor argument or the `VOLCANO_API_URL` environment variable. The code does not validate the URL scheme, hostname, port, or path before attaching sensitive authentication headers and transmitting the synthesis payload. Consequently, the client will send the following information to any configured destination: - Volcengine APP ID - Volcengine Access Token in `X-Api-Access-Key` - The same Access Token in the `Authorization` header - Resource identifier - User-supplied text submitted for speech synthesis - Speaker and audio configuration The endpoint override is also not documented in `SKILL ...[truncated 2002 chars]- Remediation
View remediation
str: parsed = urlparse(url) if ( parsed.scheme != "https" or parsed.hostname ! ...[truncated 596 chars]