T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/a_stock_daily_report.py:18- Finding
Financial market data retrieved over unencrypted HTTP
- Content
View full analysis
Optional[Dict]: """发送 GET 请求""" try: resp = self.session.get(url, params=params, timeout=self.timeout) resp.raise_for_status() return resp.json() except Exception as e: print(f"请求失败：{e}") return None ``` ### Technical Analysis The Eastmoney API base URL uses plaintext HTTP. Consequently, requests and responses lack transport confidentiality, server authentication, and integrity protection. The script accepts the returned JSON without an independent authenticity check and incorporates its values directly into the generated financial report. An attacker able to control or intercept the network path could impersonate the API endpoint or alter its responses. The expected JSON structure could be preserved while index values, stock prices, percentage changes, sector rankings, and stock names are replaced with attacker-selected values. ### Attack Path 1. A user runs the report script on a network observed or controlled by an attacker, such as a compromised router, proxy, access point, or upstream network. 2. The script requests `http://push2.eastmoney.com/api/qt/...`. 3. Because the connection does not use TLS, the attacker intercepts the request and returns a forged HTTP response. 4. The forged response contains syntactically valid JSON with manipulated financial values. 5. `_get()` accepts and parses the response. 6. `generate_report()` presents the manipulated values as legitimate market information. ### Impact Assessment This issue does not directly gra ...[truncated 402 chars]- Remediation
View remediation