T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/fetch_stock.py:112
- Finding
- Unauthenticated HTTP Transport Allows Financial Market Data Manipulation<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/fetch_stock.py:112` - `scripts/fetch_stock.py:121-126` - `scripts/fetch_stock.py:166` - `scripts/fetch_stock.py:194-200` - Related endpoint documentation: `references/data-sources.md:9-14`, `references/data-sources.md:28-29`, `references/data-sources.md:54-62` **Vulnerability Type**: Unauthenticated plaintext transport for security-sensitive financial data **Risk Level**: Medium ### Vulnerable Code Single-stock quote retrieval from Sina Finance: ```python symbol = f"{prefix}{clean_code}" url = f"http://hq.sinajs.cn/list={symbol}" raw = fetch_url(url) ``` Fallback single-stock quote retrieval from Eastmoney: ```python market = 1 if prefix == "sh" else 0 url2 = ( f"http://push2.eastmoney.com/api/qt/stock/get" f"?secid={market}.{clean_code}" f"&fields=f43,f44,f45,f46,f47,f48,f57,f58,f60,f107,f169,f170,f171" ) raw2 = fetch_url(url2, {"Referer": "https://www.eastmoney.com"}) ``` Market-index retrieval: ```python symbols = "s_sh000001,s_sz399001,s_sz399006,s_sh000688" names_map = { "s_sh000001": "上证指数", "s_sz399001": "深证成指", "s_sz399006": "创业板指", "s_sh000688": "科创50", } url = f"http://hq.sinajs.cn/list={symbols}" raw = fetch_url(url) ``` Hot-sector retrieval: ```python url = ( "http://push2.eastmoney.com/api/qt/clist/get" "?pn=1&pz=20&po=1&np=1&ut=bd1d9ddb04089700cf9c27f6f7426281" "&fltt=2&invt=2&fid=f3" "&fs=m:90+t:2+f:!50" "&fields=f2,f3,f4,f12,f14,f20,f128,f136,f207,f208,f209" ) raw = fetch_url(url, {"Referer": "https://www.eastmoney.com"}) ``` ### Technical Analysis The implemented financial-data requests use plaintext HTTP rather than authenticated TLS. HTTP provides no server authentication or transport integrity. An attacker capable of observing or modifying the network path can therefore intercept a request and substitute a fabricated response. The parsers trust returned numeric and textual fields after only basic syntax and type conve ...[truncated 2295 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Use authenticated TLS for every endpoint** - Replace each `http://` endpoint with a provider-supported `https://` endpoint. - Do not silently fall back to plaintext HTTP if an HTTPS request fails. 2. **Prevent protocol downgrades** - Reject redirects whose destination scheme is not HTTPS. - Consider using a custom redirect handler that explicitly enforces an HTTPS-only policy. 3. **Retain strict certificate validation** - Use Python's default trusted certificate verification. - Do not introduce unverified SSL contexts or disable hostname checking. - Fail closed when certificate validation fails. 4. **Validate response identity and schema** - Verify that the returned symbol exactly matches the requested symbol. - Enforce required fields, expected data types, plausible numeric ranges, and valid timestamps. - Reject incomplete, stale, malformed, or internally inconsistent responses. 5. **Corroborate data used for trading guidance** - For recommendations with financial impact, compare quotes through at least two independent HTTPS sources. - Refuse to issue actionable guidance when sources differ beyond a defined tolerance. - Clearly identify when only one source is available. 6. **Update the endpoint documentation** - Replace the plaintext examples in `references/data-sources.md` with verified HTTPS endpoints. - Explicitly prohibit plaintext fallback in the Skill's operational instructions. 7. **Add automated security tests** - Test that all configured endpoint URLs use HTTPS. - Test that HTTP redirects and invalid certificates are rejected. - Test that mismatched symbols, stale timestamps, impossible prices, and malformed responses fail closed. ]]>