T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:94- Finding
API Credential Transmitted in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/api/search.js:59-62, 104-107;src/api/post.js:23-25, 50-54;src/api/comment.js:38-40, 67-71;src/api/hot.js:19-21;src/utils/request.js:94-110, 123-137
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
The API modules insert the token into the query-parameter object:
js const params = { _: Date.now(), token: token, };Search-result polling repeats the token in the query string:
js const params = { _: Date.now(), token: token, keyword: keyword, sort_type: sort, publish_time: time, filter_duration: duration, content_type: content, limit: limit, };The request utility serializes the complete parameter object into the URL:
js async function postJson(path, params, data) { if (!path || typeof path !== "string") { throw new SkillError("PATH_INVALID", "path 必须是非空字符串"); } if (!params || typeof params !== "object") { throw new SkillError("PARAM_INVALID", "params 必须是对象"); } if (!data || typeof data !== "object") { throw new SkillError("DATA_INVALID", "data 必须是对象"); } params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Accept-Encoding": "identity", "Content-Length": Buffer.byteLength(jsonData), }, }; return await request(options, jsonData); }The same behavior occurs for GET requests:
js async function getJson(path, params) { if (!path || typeof path !== "string") { throw new SkillError("PATH_INVALID", "path 必须是非空字符串"); } if (!params || typeof params !== "object") { throw new SkillError(" ...[truncated 2065 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove
tokenfrom every query-parameter object insrc/api/search.js,src/api/post.js,src/api/comment.js, andsrc/api/hot.js. -
Pass the credential in an HTTP authorization header, such as:
js headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", "Accept-Encoding": "identity", } -
Refactor
getJsonandpostJsonto accept authentication separately from ordinary query parameters. -
Ensure request and error logging redacts
Authorization, tokens, and other credentials. -
Review server, reverse-proxy, and observability logs for previously retained token-bearing URLs.
-
Rotate tokens that may already have been exposed through URL logging.
-
Configure short token lifetimes, revocation support, quota limits, and narrowly scoped permissions where supported.
-