T09 · Insecure Skill Coding Practices
- Location
scripts/showstart_api.py:13- Finding
Cleartext HTTP Exposes Search Parameters and Precise Location Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/showstart_api.py, lines 13 and 31; location data is constructed at lines 188–192
Vulnerability Type: Cleartext transmission of potentially sensitive data
Risk Level: MediumVulnerable Code
python # API configuration BASE_URL = "http://skill.showstart.com"python def _make_request(params: Dict[str, Any]) -> Optional[Dict]: """Send an API request.""" _rate_limit() try: response = requests.get(BASE_URL, params=params, timeout=10) response.raise_for_status() return response.json() except Exception as e: print(f"Error: {e}", file=__import__('sys').stderr) return NonePrecise coordinates are included in the query string:
python result = _make_request({ "loc": f"{longitude},{latitude}", "pageNo": page_no, "pageSize": page_size })Technical Analysis
The client sends requests to
http://skill.showstart.comwithout transport encryption. This differs fromreferences/api_docs.md, which specifieshttps://skill.showstart.com/.All request parameters are placed in the URL query string. Depending on the selected operation, these parameters can contain search interests, artist or venue names, city information, and precise longitude and latitude coordinates. Because the initial request uses HTTP, an HTTP-to-HTTPS redirect would not adequately protect it: the initial URL and its query parameters have already crossed the network in cleartext.
An on-path attacker can observe or modify HTTP traffic. The client subsequently trusts the returned JSON and prints fields such as event titles, venue details, and ticket URLs. Although displayed ticket links are not opened automatically, response manipulation could present users with fraudulent information or malicious links.
Attack Path
- A user invokes a search function, such as
search_nearby(longitude, latitude). - The function places the exact coordinates in ...[truncated 1107 chars]
- A user invokes a search function, such as
- Remediation
View remediation
Remediation Suggestions
- Replace the plaintext endpoint with HTTPS:
python BASE_URL = "https://skill.showstart.com"- Keep TLS certificate verification enabled. Do not set
verify=Falseinrequests. - Reject redirects that downgrade the request from HTTPS to HTTP, or explicitly validate the final response URL before processing the response.
- Where exact location is unnecessary, reduce coordinate precision or request user consent before transmitting precise coordinates.
- Validate the response schema and restrict displayed ticket links to expected HTTPS hosts.
- Sanitize or escape untrusted API text before terminal display to reduce terminal-control-sequence risks.
- Add automated tests that assert the configured endpoint uses the
httpsscheme.