提交 #1033606: https://github.com/chenyme/ grok2api v3.1.6 Improper Enforcement of Behavioral Workflow

STT billing is bypassed when a client disconnects after receiving a completed transcription

Affected versions: confirmed present in the latest tagged release, v3.1.6, and on the default branch `main` at commit `7c889a960e2638341b4dae9a5c81af0e0f38c87f`.

## Summary

A client with a valid STT-capable API key can open a streaming speech-to-text WebSocket, receive a completed transcription, and then terminate the connection abnormally rather than closing it cleanly. The gateway records the transport error in its audit log but omits the already-confirmed transcription cost, so the client key's spending counter is never advanced for that usage, even though the upstream service already performed and returned the work.

## Details

`backend/internal/transport/http/inference/voice_ws_handler.go` records the duration from a `transcript.done` event as soon as it is observed, then separately maps an abnormal client-side close to `client_stream_interrupted`. `backend/internal/application/gateway/voice_ws.go`'s finalizer:

```go
successful := strings.TrimSpace(outcome.ErrorCode) == ""
...
if successful && operation == audit.OperationSTT {
if pricing, priced := audit.EstimateOfficialSTTCost(outcome.AudioDurationSeconds, true); priced {
record.EstimatedCostInUSDTicks = pricing.CostInUSDTicks
...
}
}
```

Pricing only happens when `successful` is true, i.e. when `ErrorCode` is empty. An abnormal client disconnect after a confirmed duration sets `ErrorCode` to `client_stream_interrupted`, which makes `successful` false and skips pricing entirely, discarding an already-confirmed positive duration. `backend/internal/infra/persistence/relational/audit_repository.go` only advances billed usage when `EstimatedCostInUSDTicks` is positive, so this record contributes nothing to the key's spending.

## POC

(available upon request)

## Impact

Any client with a valid STT-capable API key can avoid being billed for confirmed transcription usage simply by not closing the connection cleanly after receiving the result. Repeated across many requests, this understates the key's recorded spending against its configured `BillingLimitUSDTicks`, with the operator absorbing the upstream cost. This is a billing-accounting gap on the client's own key usage, not a cross-tenant issue: it does not expose another user's data or credentials, and it does not bypass authentication, model authorization, or concurrency limits.

Suggested fix: price confirmed STT usage based on whether a valid positive duration was received, independent of how the downstream transport later ended. A fix implementing exactly this, with a regression test, is included in the linked pull request.

• 来源: ⚠️ https://github.com/chenyme/grok2api/issues/1072
• 用户: carfeii (UID 97470)
• 提交: 2026-10-14 14時59分 (23 日前)
• 管理: 2026-11-06 15時44分 (23 days later)
• 状态: 已接受
• VulDB条目: 431934 [chenyme grok2api 直到 3.1.6 STT Billing voice_ws_handler.go 权限提升]
• 积分: 20