T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/run_benchmark.py:183
- Finding
- Unrestricted PaddleOCR Endpoint Can Expose Image Data and Authentication Tokens<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run_benchmark.py:183-201` **Vulnerability Type**: Arbitrary external endpoint and insecure transport handling **Risk Level**: Medium ### Vulnerable Code ```python def ocr_paddleocr(image_path, model_id=None): import requests endpoint = os.environ.get('PADDLEOCR_ENDPOINT', '') if not endpoint: raise RuntimeError('PADDLEOCR_ENDPOINT not set — PaddleOCR is optional, set env var to enable') token = os.environ.get('PADDLEOCR_TOKEN', '') with open(image_path, 'rb') as f: img_b64 = base64.b64encode(f.read()).decode() t0 = time.time() resp = requests.post( endpoint, json={'image': img_b64}, headers={'Authorization': f'token {token}'} if token else {}, timeout=30, ) latency = round(time.time() - t0, 2) resp.raise_for_status() ``` ### Technical Analysis The PaddleOCR endpoint is read directly from the `PADDLEOCR_ENDPOINT` environment variable and passed to `requests.post` without validating its scheme, hostname, port, or trust boundary. The code therefore permits arbitrary destinations, including untrusted external servers, internal network services, and plaintext `http://` endpoints. The complete selected image is Base64-encoded and placed in the request body. Base64 is a transport encoding and does not provide encryption or confidentiality. If `PADDLEOCR_TOKEN` is configured, it is also sent in the `Authorization` header. When a plaintext HTTP endpoint is used, network observers may recover both the image and token. Sending image contents to a remote OCR provider is consistent with the Skill's declared functionality and is documented in `SKILL.md`; therefore, the encoding is not itself evidence of covert exfiltration. The vulnerability is that the implementation does not enforce secure transport or constrain the destination. This exceeds a safe least-privilege design because a configuration change can redirect ...[truncated 1596 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse the endpoint with `urllib.parse.urlparse` before making the request. 2. Require the `https` scheme and reject plaintext HTTP, embedded URL credentials, fragments, and unsupported schemes. 3. Maintain an explicit allowlist of approved PaddleOCR hostnames where deployment requirements permit it. 4. Resolve the hostname and reject loopback, link-local, private, multicast, and reserved IP ranges unless access to a specifically approved internal service is required. 5. Require explicit user confirmation or a dedicated opt-in flag before transmitting an image to an external endpoint. 6. Clearly warn users that image contents leave the local system and that Base64 is not encryption. 7. Never attach `PADDLEOCR_TOKEN` unless the destination has passed scheme and hostname validation. 8. Consider certificate pinning or private certificate-authority validation for controlled enterprise endpoints. 9. Use a narrowly scoped, revocable OCR token and rotate it immediately if disclosure is suspected. 10. Document the approved endpoint and data-retention policy so users can make an informed decision before submitting sensitive images. ]]>