T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:94- Finding
API Authentication Token Exposed in URL Query Strings
- Content
View full analysis
{ const res = await getJson("/api/douyin/hot-search", { _: Date.now(), token: token, }); return res.data; }, constants.QUERY_MAX_ATTEMPTS, (attempt, err) => { utils.printError( `【获取抖音热榜重试】 ${attempt + 1}/${constants.QUERY_MAX_ATTEMPTS} 次 - ${err.message}`, ); }, ); } ``` The request utility serializes every parameter, including the token, into the URL: ```js async function postJson(path, params, data) { if (!path || typeof path !== "string") { throw new SkillError("PATH_INVALID", "path 必须是非空字符串"); } if (!params || typeof params !== "object") { throw new SkillError("PARAM_INVALID", "params 必须是对象"); } if (!data || typeof data !== "object") { throw new SkillError("DATA_INVALID", "data 必须是对象"); } params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", ...[truncated 2932 chars]- Remediation
View remediation
``` 3. If the backend requires a custom header, use a clearly designated secret header such as `X-API-Token`. 4. Update both GET and POST request builders to accept authentication separately from ordinary parameters. 5. Configure origin servers, reverse proxies, API gateways, and monitoring systems to redact authentication headers. 6. Audit existing access and diagnostic logs for leaked tokens, then securely delete or redact affected records. 7. Rotate all tokens that may previously have appeared in query strings. 8. Add automated tests asserting that generated request paths never contain `token`, `GUAIKEI_API_TOKEN`, or the test credential value. 9. Avoid including full request URLs in future error messages or diagnostics. ]]>