T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:100- Finding
API Token Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:100-107, 128-134; token-bearing parameters originate fromsrc/api/search.js:59-62, 104-107,src/api/post.js:23-25, 50-53,src/api/comment.js:38-40, 67-70, andsrc/api/hot.js:19-22
Vulnerability Type: Sensitive credential exposure through request URLs
Risk Level: MediumVulnerable Code
js const params = { _: Date.now(), token: token, };js const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Accept-Encoding": "identity", "Content-Length": Buffer.byteLength(jsonData), }, };The same behavior occurs for GET requests:
js const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Accept-Encoding": "identity" }, }; return await request(options);Technical Analysis
The value of
GUAIKEI_API_TOKENis inserted into theparamsobject and serialized directly into the URL query string. Although the connection uses HTTPS, transport encryption does not prevent the complete request URL from being retained after TLS termination.Query strings are commonly recorded by web-server access logs, reverse proxies, API gateways, application performance monitoring systems, error diagnostics, and traffic-analysis infrastructure. Consequently, systems or personnel that should only have access to operational logs may also receive a reusable authentication token.
Authentication secrets should not be placed in URLs. They should be transmitted through an authorization header or another dedicated secret-bearing header, with explicit redaction in diagnostics.
Attack Path
- A user configures a va ...[truncated 892 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove
tokenfrom every URL parameter object. -
Send the credential through a standard authorization header, for example:
js headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", "Accept-Encoding": "identity", } -
Refactor
getJson()andpostJson()so credentials are accepted separately from ordinary query parameters. -
Configure API servers, proxies, and monitoring systems to redact
Authorizationand any legacy token parameters. -
Do not include request headers or token-bearing URLs in error messages or debug output.
-
Rotate existing tokens because they may already have been retained in infrastructure logs.
-
Add automated tests asserting that generated request paths never contain
token,api_token, or the configured secret value.
-