T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/license_gate.py:17
- Finding
- License credentials and machine fingerprint transmitted over plaintext HTTP## Vulnerability Details **File Location**: `scripts/license_gate.py:17-19, 58-103` **Vulnerability Type**: Cleartext transmission of sensitive authentication and device-identification data **Risk Level**: High ### Vulnerable Code ```python # Default license service, overridable through TMO_LICENSE_SERVER _DEFAULT_LICENSE_SERVER = "http://120.27.202.105:8000" _LICENSE_ENV = os.environ.get("TMO_LICENSE_SERVER") LICENSE_SERVER_URL = (_LICENSE_ENV if _LICENSE_ENV is not None and _LICENSE_ENV.strip() != "" else _DEFAULT_LICENSE_SERVER).rstrip("/") ``` ```python def _http_post_json(url: str, payload: dict[str, Any], timeout: float = 10.0) -> dict[str, Any]: body = json.dumps(payload).encode("utf-8") req = urllib.request.Request( url, data=body, headers={"Content-Type": "application/json"}, method="POST", ) try: with urllib.request.urlopen(req, timeout=timeout) as resp: text = resp.read().decode("utf-8") data = json.loads(text or "{}") return data if isinstance(data, dict) else {} except urllib.error.HTTPError as exc: try: text = exc.read().decode("utf-8") data = json.loads(text or "{}") if isinstance(data, dict) and "detail" in data: raise LicenseError(f"授权服务器错误: {data['detail']}") from exc except Exception: pass raise LicenseError(f"授权服务器响应异常 (HTTP {exc.code})，请稍后重试。") from exc except urllib.error.URLError as exc: raise LicenseError("无法连接授权服务器，请检查服务器是否可访问或稍后重试。") from exc ``` ```python def _remote_activate(card_key: str, machine_fp: str) -> dict[str, Any]: if not LICENSE_SERVER_URL: raise LicenseError("未配置授权服务器地址，请设置环境变量 TMO_LICENSE_SERVER。") url = f"{LICENSE_SERVER_URL}/api/activate" data = _http_post_json(url, {"card_key": card_key, "machine_fp": machine_fp}) ...[truncated 3131 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the default endpoint with an HTTPS URL backed by a valid certificate. 2. Reject any license-server URL whose scheme is not `https`. 3. Retain standard certificate and hostname validation; do not introduce an option that disables TLS verification. 4. Avoid sending the reusable card key during every license check. Exchange it once for a revocable, scoped token with a short validity period. 5. Authenticate license responses using a server-side digital signature that the client verifies with an embedded public key. 6. Add replay resistance, such as a client nonce, timestamp, and signed response binding the result to the request. 7. Minimize device information used for licensing and document the collection and retention of the machine fingerprint. 8. Rotate or invalidate card keys that may already have traversed the plaintext service. 9. Apply rate limiting, activation limits, anomaly detection, and revocation controls on the server.