T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/chanjing_get_token.py:22
- Finding
- Environment-Controlled API Base URL Can Exfiltrate Chanjing Credentials## Vulnerability Details **File Location**: `scripts/chanjing_get_token.py`, lines 22–34, 67–76, and 110–111 **Vulnerability Type**: Unvalidated credential transmission endpoint **Risk Level**: High ### Vulnerable Code ```python def openapi_base_url() -> str: return ( os.environ.get("CHANJING_OPENAPI_BASE_URL") or os.environ.get("CHANJING_API_BASE") or _DEFAULT_OPENAPI_BASE ).rstrip("/") CONFIG_DIR = credentials_config_dir() CONFIG_FILE = CONFIG_DIR / "credentials.json" API_URL = openapi_base_url() + "/open/v1/access_token" ``` ```python def fetch_token(app_id, secret_key): req = urllib.request.Request( API_URL, data=json.dumps({"app_id": app_id, "secret_key": secret_key}).encode("utf-8"), headers={"Content-Type": "application/json"}, method="POST", ) with urllib.request.urlopen(req, timeout=30) as resp: body = json.loads(resp.read().decode("utf-8")) return body ``` ```python try: resp = fetch_token(app_id, secret_key) except Exception as e: print(f"请求 Token 失败: {e}", file=sys.stderr) sys.exit(1) ``` ### Technical Analysis The token client reads `CHANJING_OPENAPI_BASE_URL` or the legacy `CHANJING_API_BASE` directly from the process environment and uses the resulting value as the destination for a request containing both `app_id` and `secret_key`. The implementation does not validate: - That the URL uses HTTPS. - That the destination hostname is `open-api.chanjing.cc`. - That the port is expected. - That the URL does not contain embedded user information. - That redirects remain on the approved host. Although `manifest.yaml` documents a network allowlist, the Python code does not enforce that allowlist itself. Security therefore depends on the runtime sandbox applying the manifest correctly. In an execution environment that does not enforce it, or where network policy ...[truncated 1508 chars]
- Remediation
- ## Remediation Suggestions 1. Remove production endpoint overrides unless custom deployments are an explicit requirement. 2. Parse the URL with `urllib.parse.urlsplit` and require: - Scheme exactly equal to `https`. - Hostname exactly equal to `open-api.chanjing.cc`, or a narrowly defined trusted-host allowlist. - No embedded username or password. - Only an approved port, normally 443. 3. Reject malformed URLs and values containing unexpected path, query, or fragment components. 4. Disable redirects for the credential request or validate every redirect destination against the same HTTPS hostname allowlist. 5. Treat manifest-level network restrictions as defense in depth rather than the only enforcement mechanism. 6. If custom endpoints must remain supported, require explicit user approval and clearly warn that AK/SK will be transmitted to the configured host. 7. Add automated tests proving that HTTP URLs, unapproved hosts, unusual ports, and cross-host redirects are rejected.