T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/stock_summary.py:31
- Finding
- Unencrypted transport permits manipulation of stock data and trading signals<![CDATA[ ## Vulnerability Details **File Location**: `scripts/stock_summary.py`, lines 31-55 **Vulnerability Type**: Plaintext HTTP transport for externally sourced financial data **Risk Level**: Medium ### Vulnerable Code ```python url = f'http://push2.eastmoney.com/api/qt/stock/get?secid=1.{code}&fields=f43,f44,f45,f46,f47,f48,f57,f58,f60,f107,f169,f170' try: r = requests.get(url, timeout=5) d = r.json()['data'] ``` ```python url = f'http://push2his.eastmoney.com/api/qt/stock/kline/get?secid=1.{code}&fields1=f1,f2,f3,f4,f5,f6&fields2=f51,f52,f53,f54,f55,f56,f57&klt=101&fqt=1&end=20500101&lmt=30' try: r = requests.get(url, timeout=5) data = r.json()['data']['klines'] ``` ### Technical Analysis The A-share quote and historical-data functions retrieve financial information over unencrypted HTTP. HTTP provides neither transport confidentiality nor server authenticity and does not protect response integrity. An attacker able to observe or modify network traffic—such as a compromised router, malicious access point, proxy, or network-adjacent adversary—can alter the returned JSON and K-line records. The application trusts these values and uses the historical closing prices to calculate RSI and MACD indicators and to produce buy, sell, or hold recommendations. The requests also do not call `raise_for_status()` or perform robust response-schema and financial-value validation. This makes manipulated or unexpected responses more likely to be accepted or handled ambiguously. ### Attack Path 1. A user invokes the skill with an A-share stock code. 2. The script sends quote and historical-data requests over plaintext HTTP. 3. A network-positioned attacker intercepts one or both requests. 4. The attacker returns modified JSON containing manipulated prices, volume, or historical K-line values. 5. The script parses the response without authenticating its origin or validating the financial values. 6. The manipulated historical prices are passed to the R ...[truncated 647 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the HTTP endpoints with official HTTPS equivalents and retain normal TLS certificate verification. 2. Reject redirects from HTTPS to HTTP. 3. Call `r.raise_for_status()` before parsing each response. 4. Validate the response schema, including the presence and expected types of all required fields. 5. Apply reasonable range and consistency checks to prices, dates, and volume before using them. 6. Fail closed when authentication, parsing, or validation fails instead of generating a recommendation from questionable data. 7. Consider cross-checking high-impact financial values against a second trusted source. 8. Log failures without recording sensitive request metadata unnecessarily. ]]>