T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:14- Finding
Plaintext HTTP Endpoints Are Accepted and Explicitly Recommended
- Content
View full analysis
Dict: try: url = f"{self.api_url}{endpoint}" if method == 'GET': response = requests.get(url, params=params, timeout=30) elif method == 'POST': response = requests.post(url, json=data, params=params, timeout=30) ``` The documentation explicitly provides plaintext endpoint examples: ```text TDX_API_URL=http://your-api-domain.com AKSHARE_API_URL=http://your-akshare-api.com ``` ### Technical Analysis The constructor accepts arbitrary URL strings without parsing or enforcing an HTTPS scheme. All API operations subsequently use the configured URL directly. This includes stock symbols, search keywords, date ranges, watchlists, task identifiers, remote storage-directory values, and remote task-management commands. When the documented `http://` configuration is used, TLS does not protect the traffic. An on-path attacker can inspect requests, observe potentially private investment interests or search activity, modify returned financial information, or tamper with task-management responses. Thi ...[truncated 2348 chars]- Remediation
View remediation
str: parsed = urlparse(value) if parsed.scheme != "https": raise ValueError("API endpoints must use HTTPS") if not parsed.hostname or parsed.username or parsed.password: raise ValueError("Invalid API endpoint") return value.rstrip("/") ``` ]]>