T09 · Insecure Skill Coding Practices
Error
- Location
- references/web-dashboard-setup.md:55
- Finding
- Public Analysis Endpoint Transmits User-Supplied Financial Content over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `references/web-dashboard-setup.md`, lines 55-89 **Vulnerability Type**: Plaintext transmission of potentially sensitive user input **Risk Level**: High ### Vulnerable Code ```nginx server { listen 80; server_name racingai.top www.racingai.top; # Event-driven trading dashboard location /event-driven { proxy_pass http://127.0.0.1:5566; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } # Analysis API location = /api/analyze { proxy_pass http://127.0.0.1:5566; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_read_timeout 120s; } # Health check location = /api/health { proxy_pass http://127.0.0.1:5566; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } # Other traffic location / { proxy_pass http://127.0.0.1:5173; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; } } ``` The documentation also explicitly tests the production API over HTTP: ```bash curl http://racingai.top/api/health curl -X POST http://racingai.top/api/analyze -H 'Content-Type: application/json' -d '{"text":"央行降准0.5个百分点"}' ``` ### Technical Analysis The documented public nginx server listens only on TCP port 80 and provides no TLS listener or redirect to HTTPS. Consequently, news submitted to `/api/analyze` and the resulting investment analysis cross the client-facing network in plaintext. Although the backend subsequently sends the news to Baidu Qianfan through HTTPS, that protection does not ...[truncated 1793 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Configure nginx with a valid TLS certificate and serve the dashboard and API exclusively over HTTPS. 2. Redirect all port 80 traffic to HTTPS: ```nginx server { listen 80; server_name racingai.top www.racingai.top; return 301 https://$host$request_uri; } ``` 3. Add a TLS-enabled virtual host: ```nginx server { listen 443 ssl; server_name racingai.top www.racingai.top; ssl_certificate /path/to/fullchain.pem; ssl_certificate_key /path/to/privkey.pem; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; location = /api/analyze { proxy_pass http://127.0.0.1:5566; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_read_timeout 120s; } } ``` 4. Change every documented dashboard and API URL from `http://` to `https://`. 5. Add an explicit privacy notice explaining that submitted text is transferred to Baidu Qianfan and warning users not to submit confidential or regulated information. 6. Require authentication and authorization for `/api/analyze` if it is not intended to be a fully public service. 7. Add request-size limits, rate limiting, access logging, and abuse monitoring. 8. Validate deployment automatically to ensure that production API requests cannot be completed over plaintext HTTP. ]]>