T09 · Insecure Skill Coding Practices
- Location
scripts/index.py:66- Finding
Signed API Credentials May Be Disclosed Through Query Strings and Exception Logging
- Content
View full analysis
Vulnerability Details
File Location:
scripts/index.py:66-77,scripts/index.py:223-228, andscripts/index.py:260-264
Vulnerability Type: Sensitive authentication data exposure through URL query parameters and unsanitized error logging
Risk Level: MediumVulnerable Code
python authorization_origin = "api_key=\"%s\", algorithm=\"%s\", headers=\"%s\", signature=\"%s\"" % ( self.api_key, "hmac-sha256", "host date request-line", signature_sha ) authorization = base64.b64encode( authorization_origin.encode('utf-8') ).decode(encoding='utf-8') values = { "authorization": authorization, "host": host, "date": date } return api_url + "?" + urlencode(values)python signed_url = self.create_signed_url(self.host_url, "POST") print("Calling face compare API...") response = requests.post( signed_url, json=request_body, timeout=self.timeout ) response.raise_for_status()python except requests.exceptions.RequestException as e: print(f"Network request error: {str(e)}") return { "success": False, "error": f"Network request error: {str(e)}" }Technical Analysis
The script constructs an authentication value containing the iFlytek API key, HMAC algorithm metadata, signed headers, and request signature. It Base64-encodes this value and places it in the request URL's query string.
Base64 is an encoding mechanism and provides no confidentiality. URL query strings are commonly captured by application diagnostics, HTTP clients, proxies, gateways, monitoring platforms, and log aggregation systems. Although HTTPS protects the request while it is in transit, it does not prevent the complete URL from being recorded at either endpoint or by local instrumentation.
The exception handler compounds this exposure by printing and returning the raw
requests.exceptions.RequestException. Such exceptions ...[truncated 2355 chars]- Remediation
View remediation
Remediation Suggestions
-
Sanitize network exceptions
- Do not print or return the raw
RequestException. - Return only safe information such as the exception class, a generic message, and a sanitized HTTP status code.
- Never include request URLs, query parameters, authorization values, signatures, API keys, or secrets in user-visible errors.
python except requests.exceptions.RequestException as e: safe_error = f"Face comparison request failed: {type(e).__name__}" print(safe_error) return { "success": False, "error": safe_error } - Do not print or return the raw
-
Redact signed URLs
- If diagnostic URL logging is necessary, parse the URL and replace
authorization,signature, and other credential-bearing parameters with[REDACTED]. - Apply the same redaction to application logs, proxy logs, tracing systems, and error-reporting platforms.
- If diagnostic URL logging is necessary, parse the URL and replace
-
Use safer authentication transport when supported
- Follow the provider's official authentication specification.
- If iFlytek supports equivalent authentication headers, send authorization metadata in headers instead of the query string.
- If query-string authentication is mandatory, ensure that the signed URL is never printed, returned, persisted, or captured by telemetry.
-
Limit credential exposure
- Use API credentials dedicated to this Skill.
- Apply provider-side quotas, endpoint restrictions, and the narrowest available permissions.
- Rotate credentials if signed URLs may already have appeared in logs.
-
Harden biometric-data handling
- Clearly disclose that both facial images are transmitted to iFlytek for processing.
- Obtain appropriate user consent and document provider retention and privacy terms.
- Avoid logging image payloads, API responses containing unnecessary personal data, or full request bodies.
-