T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:94- Finding
API Credential Transmitted in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Locations:
src/api/search.js:59-62, 104-107src/api/post.js:23-26, 50-53src/api/comment.js:38-41, 67-70src/api/hot.js:19-22src/utils/request.js:94-120, 123-140
Vulnerability Type: Sensitive credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
The API modules add the secret token to a request parameter object. For example, the comment task does so as follows:
js async function createCommentTask(token, url, limit) { const params = { _: Date.now(), token: token, }; const data = { url, limit, }; return await requestApi( "POST", "/api/douyin/comment/url", params, data, constants.CREATE_MAX_ATTEMPTS, "创建任务", ); }The shared HTTP client then serializes the parameter object directly into the URL for both POST and GET requests:
js async function postJson(path, params, data) { if (!path || typeof path !== "string") { throw new SkillError("PATH_INVALID", "path 必须是非空字符串"); } if (!params || typeof params !== "object") { throw new SkillError("PARAM_INVALID", "params 必须是对象"); } if (!data || typeof data !== "object") { throw new SkillError("DATA_INVALID", "data 必须是对象"); } params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Accept-Encoding": "identity", "Content-Length": Buffer.byteLength(jsonData), }, }; return await request(options, jsonData); } async function getJson(path, params) { if (!path || typeof path !== "string") { throw new SkillError("PATH_INVALID", "path 必须是非空字符串"); } if (!params || typeof p ...[truncated 2416 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
tokenfrom every query parameter object. - Send the credential in a dedicated request header, preferably:
js headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", "Accept-Encoding": "identity", } - Refactor
getJsonandpostJsonto accept the token separately from ordinary request parameters, preventing accidental serialization into the URL. - Configure proxies, gateways, application logs, and telemetry to redact authorization headers and any legacy
tokenquery parameter. - Rotate existing API tokens because historical infrastructure logs may already contain them.
- Add automated tests asserting that generated request paths never contain
token,api_key,secret, or equivalent credential fields. - Ensure error messages and retry logs never include complete request options or authorization values.
- Remove