T09 · Insecure Skill Coding Practices
Error
- Location
- stock_utils.py:26
- Finding
- Tushare API Token Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `stock_utils.py:26-110` **Vulnerability Type**: Cleartext transmission of sensitive credentials **Risk Level**: High ### Vulnerable Code ```python TUSHARE_API_URL = "http://api.tushare.pro" ``` ```python payload: Dict[str, Any] = { "api_name": api_name, "token": token, "params": params, } if fields: payload["fields"] = fields headers = {"Content-Type": "application/json"} for attempt in range(retries + 1): try: response = requests.post( TUSHARE_API_URL, json=payload, headers=headers, timeout=DEFAULT_TIMEOUT, ) ``` ### Technical Analysis The application places the user's Tushare API token in a JSON request body and sends it to an `http://` endpoint. HTTP provides neither transport confidentiality nor server authentication. It also does not protect response integrity. An attacker able to observe or modify traffic between the host and the API can: - Read and reuse the Tushare token. - Modify API request parameters. - Substitute market data in API responses. - Inject attacker-controlled strings into fields later included in JSON, CSV, or HTML reports. - Redirect or disrupt requests without being detected by TLS certificate validation. A timeout does not provide any confidentiality or integrity protection. The fact that the hostname is documented as the official API does not make a plaintext connection secure. ### Attack Path 1. A user configures a valid Tushare token in `config.json` or the `TUSHARE_TOKEN` environment variable. 2. The user runs a screening strategy. 3. `call_api()` adds the token to the JSON payload. 4. The application sends the payload over plaintext HTTP. 5. An attacker controlling or monitoring the local network, proxy, gateway, DNS path, or another relevant intermediary captures the request. 6. The attacker extracts and reuses the token, or modifies the API response before it reaches the applicatio ...[truncated 804 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the plaintext endpoint with the verified HTTPS endpoint: ```python TUSHARE_API_URL = "https://api.tushare.pro" ``` 2. Keep TLS certificate validation enabled. Do not set `verify=False` or install an unrestricted custom certificate bypass. 3. Reject redirects that downgrade the connection from HTTPS to HTTP. Consider disabling automatic redirects or explicitly validating every redirect target. 4. Restrict the destination hostname to the intended Tushare API host. 5. Rotate all API tokens that may previously have been transmitted through the HTTP endpoint. 6. Store the token outside the project tree, preferably in an environment variable or an operating-system credential store. 7. Add an automated test that fails when the configured API URL does not use HTTPS. 8. Avoid logging request payloads or authorization material, including in future debug changes. ]]>