T09 · Insecure Skill Coding Practices
Error
- Location
src/api/base.ts:7- Finding
Administrative API Traffic Uses Plaintext HTTP by Default
- Content
View full analysis
{ const { token, timestamp } = generateToken(this.config.apiKey); const url = `${this.config.protocol}://${this.config.host}:${this.config.port}${path}`; const response = await fetch(url, { ...options, headers: { "1Panel-Token": token, "1Panel-Timestamp": timestamp, "Content-Type": "application/json", ...options.headers, }, }); ``` The command-line wrapper independently applies the same insecure default: ```javascript const config = { host: process.env.ONEPANEL_HOST || 'localhost', port: parseInt(process.env.ONEPANEL_PORT || '8080'), apiKey: process.env.ONEPANEL_API_KEY, protocol: process.env.ONEPANEL_PROTOCOL || 'http' }; ``` The authentication token is derived as follows in `src/utils/auth.ts:3-8`: ```typescript export function generateToken(apiKey: string): { token: string; timestamp: string } { const timestamp = Math.floor(Date.now() / 1000).toString(); const token = createHash("md5") .update(`1panel${apiKey}${timestamp}`) .digest("hex"); return { token, timestamp }; } ``` ### Technical Analysis Every API request carries a timestamp and an MD5-derived authentication token. The raw API key is not transmitted directly, and the destination is the user-configured 1Panel host rather than a hard-coded third party. Network communication is necessary for the declared API-client functionality. However, the client defaults to `http`, and both the Skill documentation and installation instruction ...[truncated 2989 chars]- Remediation
View remediation