Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion dashscope/audio/qwen_omni/omni_realtime.py
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,7 @@ def _get_websocket_header(self):
)
headers = {
"user-agent": ua,
"Authorization": "bearer " + self.apikey,
"Authorization": "Bearer " + self.apikey,
}
if self.user_headers:
headers = {**self.user_headers, **headers}
Expand Down
12 changes: 11 additions & 1 deletion dashscope/audio/qwen_tts_realtime/qwen_tts_realtime.py
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,7 @@ def _get_websocket_header(self):
)
headers = {
"user-agent": ua,
"Authorization": "bearer " + self.apikey,
"Authorization": "Bearer " + self.apikey,
}
if self.user_headers:
headers = {**self.user_headers, **headers}
Expand Down Expand Up @@ -177,6 +177,8 @@ def update_session(
bit_rate: int = None,
language_type: str = None,
enable_tn: bool = None,
instructions: str = None,
optimize_instructions: bool = None,
**kwargs,
) -> None:
"""
Expand Down Expand Up @@ -206,6 +208,10 @@ def update_session(
bit_rate for tts, support 6~510,default is 128kbps. only work on format: opus/mp3 # noqa: E501 # pylint: disable=line-too-long
enable_tn: bool
enable text normalization for tts, default is None
instructions: str
instructions for tts, default is None
optimize_instructions: bool
optimize_instructions for tts, default is None
Comment on lines +211 to +214

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The docstrings for the new parameters instructions and optimize_instructions are a bit brief. To improve clarity for future users and maintainers, could you please expand on what these parameters do? For example:

  • For instructions: What kind of instructions are expected? Do they control tone, emotion, or style? An example would be very helpful.
  • For optimize_instructions: What does enabling this option do? Does it modify the instructions for better performance or quality? A brief explanation of the optimization process would be valuable.

"""
self.config = {
"voice": voice,
Expand All @@ -230,6 +236,10 @@ def update_session(

if language_type is not None:
self.config["language_type"] = language_type
if instructions is not None:
self.config["instructions"] = instructions
if optimize_instructions is not None:
self.config["optimize_instructions"] = optimize_instructions
self.config.update(kwargs)
self.__send_str(
json.dumps(
Expand Down
2 changes: 1 addition & 1 deletion dashscope/audio/tts_v2/speech_synthesizer.py
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,7 @@ def getWebsocketHeaders(self, headers, workspace):
)
self.headers = {
"user-agent": ua,
"Authorization": "bearer " + self.apikey,
"Authorization": "Bearer " + self.apikey,
}
if headers:
self.headers = {**self.headers, **headers}
Expand Down
2 changes: 1 addition & 1 deletion dashscope/multimodal/multimodal_dialog.py
Original file line number Diff line number Diff line change
Expand Up @@ -445,7 +445,7 @@ def get_websocket_header(self, api_key):
)
self.ws_headers = {
"User-Agent": ua,
"Authorization": f"bearer {api_key}",
"Authorization": f"Bearer {api_key}",
"Accept": "application/json",
}
logger.info("websocket header: %s", self.ws_headers)
Comment on lines 446 to 451

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

The api_key is included in the self.ws_headers dictionary, which is subsequently logged at the INFO level on line 451. This leads to the exposure of sensitive API keys in application logs. It is highly recommended to redact sensitive information before logging or to avoid logging the entire headers dictionary at the INFO level.

Suggested change
self.ws_headers = {
"User-Agent": ua,
"Authorization": f"bearer {api_key}",
"Authorization": f"Bearer {api_key}",
"Accept": "application/json",
}
logger.info("websocket header: %s", self.ws_headers)
self.ws_headers = {
"User-Agent": ua,
"Authorization": f"Bearer {api_key}",
"Accept": "application/json",
}
log_headers = self.ws_headers.copy()
log_headers["Authorization"] = "REDACTED"
logger.info("websocket header: %s", log_headers)

Expand Down
2 changes: 1 addition & 1 deletion dashscope/multimodal/tingwu/tingwu_realtime.py
Original file line number Diff line number Diff line change
Expand Up @@ -345,7 +345,7 @@ def get_websocket_header(self, api_key):
)
self.ws_headers = {
"User-Agent": ua,
"Authorization": f"bearer {api_key}",
"Authorization": f"Bearer {api_key}",
"Accept": "application/json",
}
logger.info("websocket header: %s", self.ws_headers)
Comment on lines 346 to 351

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

The api_key is included in the self.ws_headers dictionary, which is subsequently logged at the INFO level on line 351. This leads to the exposure of sensitive API keys in application logs. It is highly recommended to redact sensitive information before logging or to avoid logging the entire headers dictionary at the INFO level.

Suggested change
self.ws_headers = {
"User-Agent": ua,
"Authorization": f"bearer {api_key}",
"Authorization": f"Bearer {api_key}",
"Accept": "application/json",
}
logger.info("websocket header: %s", self.ws_headers)
self.ws_headers = {
"User-Agent": ua,
"Authorization": f"Bearer {api_key}",
"Accept": "application/json",
}
log_headers = self.ws_headers.copy()
log_headers["Authorization"] = "REDACTED"
logger.info("websocket header: %s", log_headers)

Expand Down