T09 · Insecure Skill Coding Practices
Error
- Location
scripts/license_gate.py:17- Finding
License credentials and machine fingerprint transmitted over plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/license_gate.py:17-19, 58-103
Vulnerability Type: Cleartext transmission of sensitive authentication and device-identification data
Risk Level: HighVulnerable Code
python # Default license service, overridable through TMO_LICENSE_SERVER _DEFAULT_LICENSE_SERVER = "http://120.27.202.105:8000" _LICENSE_ENV = os.environ.get("TMO_LICENSE_SERVER") LICENSE_SERVER_URL = (_LICENSE_ENV if _LICENSE_ENV is not None and _LICENSE_ENV.strip() != "" else _DEFAULT_LICENSE_SERVER).rstrip("/")python def _http_post_json(url: str, payload: dict[str, Any], timeout: float = 10.0) -> dict[str, Any]: body = json.dumps(payload).encode("utf-8") req = urllib.request.Request( url, data=body, headers={"Content-Type": "application/json"}, method="POST", ) try: with urllib.request.urlopen(req, timeout=timeout) as resp: text = resp.read().decode("utf-8") data = json.loads(text or "{}") return data if isinstance(data, dict) else {} except urllib.error.HTTPError as exc: try: text = exc.read().decode("utf-8") data = json.loads(text or "{}") if isinstance(data, dict) and "detail" in data: raise LicenseError(f"授权服务器错误: {data['detail']}") from exc except Exception: pass raise LicenseError(f"授权服务器响应异常 (HTTP {exc.code})，请稍后重试。") from exc except urllib.error.URLError as exc: raise LicenseError("无法连接授权服务器，请检查服务器是否可访问或稍后重试。") from excpython def _remote_activate(card_key: str, machine_fp: str) -> dict[str, Any]: if not LICENSE_SERVER_URL: raise LicenseError("未配置授权服务器地址，请设置环境变量 TMO_LICENSE_SERVER。") url = f"{LICENSE_SERVER_URL}/api/activate" data = _http_post_json(url, {"card_key": card_key, "machine_fp": machine_fp}) ...[truncated 3131 chars]- Remediation
View remediation
Remediation Suggestions
- Replace the default endpoint with an HTTPS URL backed by a valid certificate.
- Reject any license-server URL whose scheme is not
https. - Retain standard certificate and hostname validation; do not introduce an option that disables TLS verification.
- Avoid sending the reusable card key during every license check. Exchange it once for a revocable, scoped token with a short validity period.
- Authenticate license responses using a server-side digital signature that the client verifies with an embedded public key.
- Add replay resistance, such as a client nonce, timestamp, and signed response binding the result to the request.
- Minimize device information used for licensing and document the collection and retention of the machine fingerprint.
- Rotate or invalidate card keys that may already have traversed the plaintext service.
- Apply rate limiting, activation limits, anomaly detection, and revocation controls on the server.