T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:99- Finding
API Token Transmitted in URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:99-102,src/utils/request.js:128-132,src/api/search.js:58-63,src/api/search.js:103-112,src/api/post.js:23-27,src/api/post.js:50-55,src/api/comment.js:38-43,src/api/comment.js:67-72,src/api/hot.js:17-21
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
The API modules place the token in a parameter object:
js const params = { _: Date.now(), token: token, };The shared request implementation then serializes every parameter, including the token, into the URL:
js params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data);The same behavior occurs for GET requests:
js params._ = Date.now(); const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Accept-Encoding": "identity" }, };For example, the search result request includes the credential alongside user-controlled search parameters:
js const params = { _: Date.now(), token: token, keyword: keyword, sort_type: sort, publish_time: time, filter_duration: duration, content_type: content, limit: limit, }; const response = await requestApi( "GET", "/api/douyin/general-search/info", params, null, constants.QUERY_MAX_ATTEMPTS, "查询任务", );Technical Analysis
GUAIKEI_API_TOKENis used as a reusable authentication credential, but every API call transmits it as part of the request-target query string. Although HTTPS encrypts the request while it is in transit, it does not prevent the complete URL from being recorded after TLS termination.Query strings are commonly retained in web-server access logs, reverse-proxy logs, ap ...[truncated 1760 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove
tokenfrom every query-parameter object. -
Transmit the credential in an HTTP authorization header, for example:
js headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", "Accept-Encoding": "identity", } -
Refactor
getJson()andpostJson()to receive authentication separately from ordinary request parameters. -
Ensure logging and telemetry systems redact
Authorization, cookies, API keys, and any legacytokenquery parameter. -
Reject future requests that submit credentials through the query string after a reasonable migration period.
-
Rotate tokens that have already been used by affected versions, because they may exist in historical logs.
-
Add automated tests confirming that generated request paths never contain
token=, while the authorization header is present. -
Apply short expiration periods, least-privilege scopes, rate limits, and revocation support to API tokens.
-