T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/a_stock_daily_report.py:18
- Finding
- Financial market data retrieved over unencrypted HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/a_stock_daily_report.py`, lines 18-32 **Vulnerability Type**: Unauthenticated and unencrypted network transport **Risk Level**: Medium ### Vulnerable Code ```python # 东方财富 API 基础 URL BASE_URL = "http://push2.eastmoney.com/api/qt" def __init__(self, timeout: int = 5): self.timeout = timeout self.session = requests.Session() def _get(self, url: str, params: Optional[Dict] = None) -> Optional[Dict]: """发送 GET 请求""" try: resp = self.session.get(url, params=params, timeout=self.timeout) resp.raise_for_status() return resp.json() except Exception as e: print(f"请求失败：{e}") return None ``` ### Technical Analysis The Eastmoney API base URL uses plaintext HTTP. Consequently, requests and responses lack transport confidentiality, server authentication, and integrity protection. The script accepts the returned JSON without an independent authenticity check and incorporates its values directly into the generated financial report. An attacker able to control or intercept the network path could impersonate the API endpoint or alter its responses. The expected JSON structure could be preserved while index values, stock prices, percentage changes, sector rankings, and stock names are replaced with attacker-selected values. ### Attack Path 1. A user runs the report script on a network observed or controlled by an attacker, such as a compromised router, proxy, access point, or upstream network. 2. The script requests `http://push2.eastmoney.com/api/qt/...`. 3. Because the connection does not use TLS, the attacker intercepts the request and returns a forged HTTP response. 4. The forged response contains syntactically valid JSON with manipulated financial values. 5. `_get()` accepts and parses the response. 6. `generate_report()` presents the manipulated values as legitimate market information. ### Impact Assessment This issue does not directly gra ...[truncated 402 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Change the API base URL to HTTPS: ```python BASE_URL = "https://push2.eastmoney.com/api/qt" ``` 2. Preserve the default TLS certificate and hostname verification behavior in `requests`; do not introduce `verify=False`. 3. Fail closed when TLS validation, JSON decoding, or response validation fails. 4. Validate the response schema and expected value types before generating the report. 5. Consider applying reasonable value-range and format checks to reduce the effect of malformed upstream data. 6. Update the endpoint examples in `SKILL.md` to use HTTPS so the documentation does not encourage insecure transport. ]]>