T09 · Insecure Skill Coding Practices
Error
- Location
- index.py:15
- Finding
- Documents and Bearer Credentials Are Transmitted Over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `index.py:15`, `index.py:50-94`, `index.py:112-124` **Vulnerability Type**: Plaintext transmission of sensitive information **Risk Level**: High ### Vulnerable Code ```python DEFAULT_BASE_URL = "http://47.111.146.164:8088" ``` ```python config = get_config() base_url = config["base_url"].rstrip("/") api_url = f"{base_url}{DEFAULT_API_PATH}" # API Key is optional if not config["api_key"]: print("[WARN] No API Key configured; attempting request directly...") if not Path(file_path).exists(): return {"error": f"File does not exist: {file_path}"} headers = {} if config["api_key"]: headers["Authorization"] = f"Bearer {config['api_key']}" try: with open(file_path, "rb") as f: files = {"file": (Path(file_path).name, f)} data: dict = { "layout_analysis_en": 1 if layout_analysis else 0, "table_reco_en": 1 if table_recognition else 0, "seal_reco_en": 1 if seal_recognition else 0, } if output_format and output_format != "json": data["md_image_format"] = "url" if page_range: data["page_range"] = page_range response = requests.post( api_url, headers=headers, files=files, data=data, timeout=120 ) ``` ```python def get_task_status(task_id): """Query task status""" config = get_config() if not config["api_key"]: return {"error": "API Key is not configured"} try: response = requests.get( f"{config['base_url']}/{task_id}", headers={"Authorization": f"Bearer {config['api_key']}"} ) return response.json() except Exception as e: return {"error": f"Status query failed: {str(e)}"} ``` ### Technical Analysis The default service endpoint uses unencrypted HTTP. The `parse_document` function sends the entire user-selected document as a multipart uplo ...[truncated 2301 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the default endpoint with an HTTPS URL backed by a valid certificate and stable domain name. 2. Reject plaintext endpoints by default: ```python from urllib.parse import urlparse parsed = urlparse(base_url) if parsed.scheme != "https": raise ValueError("DOCUMENT_PARSER_BASE_URL must use HTTPS") ``` 3. Keep TLS certificate verification enabled. Do not introduce `verify=False` or suppress certificate warnings. 4. If private deployments genuinely require HTTP, require an explicit insecure-mode opt-in and display a prominent warning. Bearer credentials should still never be sent over plaintext HTTP. 5. Clearly disclose before use that complete documents are uploaded to a third-party or operator-controlled service. 6. Consider requiring explicit user confirmation before uploading a document, especially when the default remote service is used. 7. Document the service operator, retention policy, supported data regions, access controls, and deletion process. 8. Use narrowly scoped, revocable, and short-lived API credentials where supported. 9. Add integration tests that fail if the default endpoint or configured production endpoint uses a non-HTTPS scheme. 10. Set a timeout on the status request and call `response.raise_for_status()` before processing its body. ]]>