T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/stream_crypto_chart.py:139- Finding
API Credential Embedded in WebSocket URL
- Content
View full analysis
None: api_key = get_api_key() url = f"{BITQUERY_WS_BASE}?{urlencode({'token': api_key})}" transport = WebsocketsTransport( url=url, headers={"Sec-WebSocket-Protocol": "graphql-ws"}, ) ``` ### Technical Analysis The script places `BITQUERY_API_KEY` in the WebSocket URL as a `token` query parameter. Although the URL uses TLS and the documentation identifies this as a limitation of the Bitquery API, query parameters can be captured by transport diagnostics, exception reports, debuggers, proxy logs, network-monitoring systems, or other infrastructure that records complete connection URLs. The script does not directly print the URL or deliberately transmit the credential to an unrelated service. The credential is sent only to the declared Bitquery endpoint. Nevertheless, placing authentication material in a URL increases its exposure surface compared with authentication through a protected header. The project documentation explicitly warns users about this risk, which reduces the likelihood of accidental exposure but does not eliminate the underlying weakness. ### Attack Path 1. A user runs the streaming script with a valid `BITQUERY_API_KEY`. 2. The script constructs a WebSocket URL containing the key in the `token` query parameter. 3. A debugger, verbose transport logger, proxy, exception-monitoring service, or infrastructure component records the complete URL. 4. An attacker obtains access to the resulting diagnostic data or logs. 5. The attacker extracts the token and uses it to authenticate to Bitquery. 6. The attacker can perform actions permitted by that token, including consuming the associated API quota. This exploitation path requir ...[truncated 622 chars]- Remediation
View remediation