T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:122- Finding
API Credential Exposed in URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:122-139; credential parameters originate fromsrc/api/search.js:104-119,src/api/post.js:50-59,src/api/comment.js:67-77, andsrc/api/hot.js:19-22
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: MediumEvidence
javascript async function getJson(path, params) { if (!path || typeof path !== "string") { throw new SkillError("PATH_INVALID", "path must be a non-empty string"); } if (!params || typeof params !== "object") { throw new SkillError("PARAM_INVALID", "params must be an object"); } params._ = Date.now(); const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Accept-Encoding": "identity" }, }; return await request(options); }The API modules include the secret token in the parameter object passed to this function. For example:
javascript const params = { _: Date.now(), token: token, keyword: keyword, sort_type: sort, publish_time: time, filter_duration: duration, content_type: content, limit: limit, }; const response = await requestApi( "GET", "/api/douyin/general-search/info", params, null, constants.QUERY_MAX_ATTEMPTS, "Query task", );Technical Analysis
getJson()serializes every property inparamsinto the request URL. Because the API modules placeGUAIKEI_API_TOKENin that object, requests are sent in the form:text /api/douyin/...?...&token=SECRETHTTPS protects the request target while it is transmitted over the network, but it does not prevent the URL from being recorded at either endpoint. Full request URLs are frequently retained by reverse proxies, load balancers, web-server access logs, application-performance monitoring systems, debuggin ...[truncated 1442 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove
tokenfrom every URL parameter object. -
Send the credential through a standard authorization header:
javascript const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { Authorization: `Bearer ${token}`, "Accept-Encoding": "identity", }, }; -
Refactor the request interface so authentication is passed separately from ordinary query parameters, preventing accidental serialization.
-
Configure proxies, servers, and monitoring systems to redact sensitive query parameters while legacy clients remain supported.
-
Ensure errors and retry logs never include the request options, complete URL, authorization header, or token.
-
Rotate existing tokens if infrastructure logs may already contain request URLs.
-
Add automated tests asserting that generated request paths never contain
token=.
-