T09 · Insecure Skill Coding Practices
Note
- Location
scripts/rankings.sh:10- Finding
Unvalidated Arguments Permit Binance API Request Manipulation
- Content
View full analysis
/dev/null || echo "Parse error" ;; smart-money) if [ -z "$CHAIN_ID" ]; then CHAIN_ID="56" fi curl -s -X POST \ 'https://web3.binance.com/bapi/defi/v1/public/wallet-direct/tracker/wallet/token/inflow/rank/query/ai' \ -H 'Content-Type: application/json' \ -H 'Accept-Encoding: identity' \ -H 'User-Agent: binance-web3/2.1 (Skill)' \ -d "{\"chainId\":\"${CHAIN_ID}\",\"period\":\"24h\",\"tagType\":2}" \ | python3 -m json.tool 2>/dev/null || echo "Parse error" ;; meme) if [ -z "$CHAIN_ID" ]; then CHAIN_ID="56" fi curl -s \ "https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/market/token/pulse/exclusive/rank/list/a ...[truncated 3112 chars]- Remediation
View remediation
&2 exit 1 ;; esac ``` 2. Require `LIMIT` to be an integer within the documented range: ```bash if ! [[ "$LIMIT" =~ ^[0-9]+$ ]] || (( LIMIT < 1 || LIMIT > 200 )); then echo "Limit must be an integer between 1 and 200" >&2 exit 1 fi ``` 3. Construct POST bodies with a JSON serializer instead of string concatenation. For example: ```bash if [ -n "$CHAIN_ID" ]; then BODY="$(jq -n \ --argjson rankType "$RANK_TYPE" \ --argjson size "$LIMIT" \ --arg chainId "$CHAIN_ID" \ '{rankType:$rankType, period:50, sortBy:70, orderAsc:false, page:1, size:$size, chainId:$chainId}')" else BODY="$(jq -n \ --argjson rankType "$RANK_TYPE" \ --argjson size "$LIMIT" \ '{rankType:$rankType, period:50, sortBy:70, orderAsc:false, page:1, size:$size}')" fi ``` 4. For GET requests, use `curl --get` with `--data-urlencode` for every query parameter instead of manually concatenating query strings. 5. Add automated tests covering unsupported chains, quotation marks, ampersands, control characters, nonnumeric limits, negative limits, and values above 200. 6. Use `curl --fail-with-body --show-error` and check API success fields so malformed or rejected requests cannot be silently presented as valid ranking results. ]]>