T09 · Insecure Skill Coding Practices
Error
- Location
core/golden_tax.py:759- Finding
Arbitrary Tax Filing Endpoint Can Receive Credentials and Confidential Tax Records
- Content
View full analysis
dict: """通用第三方接口（百望云/企享云）""" if not self.api_key or not self.base_url: logger.warning(f"{self.mode} API未配置，降级模拟申报") return self._simulate_submit(tax_return, tax_type) url = f"{self.base_url}/tax/submit" payload = { "appKey": self.api_key, "taxType": tax_type.value, "period": tax_return.period.period_str, "taxId": tax_return.company.tax_id, "xmlContent": tax_return.to_xml(), } try: resp = requests.post(url, json=payload, headers={"Authorization": f"Bearer {self.api_secret}"}, timeout=15) ``` The destination originates from a constructor parameter or the environment without validation: ```python self.api_key = api_key or os.environ.get("TAX_API_KEY", "") self.api_secret = api_secret or os.environ.get("TAX_API_SECRET", "") self.base_url = base_url or os.environ.get("TAX_API_BASE_URL", "") ``` ### Technical Analysis The filing adapter sends highly sensitive business information to an unrestricted `base_url`. The transmitted payload includes: - The company tax identifier. - Filing period and tax type. - Complete XML tax returns. - Revenue, costs, expenses, tax liabilities, and company identity embedded in the XML. - The provider API key in the JSON body. - The provider secret as a bearer token. The implementation does not require HTTPS, validate the hostname or port, restrict the destination to an approved tax provider, reject embedded URL credentials, or disable redirects. Consequently, a caller or process capable of modifying `TAX_API_BASE_URL` can redirect confidential tax information and service credentials to an ...[truncated 1426 chars]- Remediation
View remediation