@qin-yu-1314/dsh-doubao-tts

resolveMessageText() passes its sessionId straight to findSessionLogFile(), and the plugin's own demo prints /dsh-doubao-tts/speak?sessionId=...&messageId=..., i.e. the value originates in the HTTP query. path.join normalises '..' segments, so a caller can redirect the reader to any directory on disk that contains a file named session.v*.jsonl(.zstd). readSessionEvents then parses it, resolveMessageText returns the conversation text for a chosen messageId, and on a miss the error carries err.knownMessageIds (last assistant message ids of that file) back to the caller — an enumeration primitive

updateEnvFile() interpolates the POSTed value verbatim (also at line 102 in the append branch). A value containing '\n' writes additional lines into volc_tts.env, contradicting the module's stated contract of only touching the keys it was given, and allowing keys outside EDITABLE_KEYS to be planted. Reachability depends on the /settings route's authorization, which lives in entry.js and was not part of the harvested source; the same settings endpoint can also rewrite VOLC_WS_URL, so whoever can call it can already redirect where credentials are sent.

clearCache() deletes all regular files in the configured cache directory without any cache-name pattern check, and VOLC_TTS_CACHE_DIR is in EDITABLE_KEYS, so the target directory can be pointed at any path and then mass-deleted (non-recursively) through /cache-clear. This is a capability of the settings owner rather than an anonymous primitive, hence low.

entry.js (which registers all /dsh-doubao-tts/* routes), lib/volc-tts.mjs, lib/protocol.mjs, lib/ws-client.mjs and client/doubao-tts.js are absent from the harvested files even though the package declares them as the loaded runtime. Authorization, CSRF/origin checks on /settings, /speak, /cache-clear, and where the API key is attached to the outbound WebSocket therefore could not be verified; the verdict below covers only the visible support libraries.