T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:105- Finding
API Token Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:105-107, 132-134; token parameters originate fromsrc/api/search.js:59-62, 104-107,src/api/comment.js:38-41, 67-70,src/api/post.js:23-26, 50-53, andsrc/api/hot.js:19-22
Vulnerability Type: Sensitive credential exposure through request URLs
Risk Level: MediumVulnerable Code
js // src/utils/request.js:105-107 const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data);js // src/utils/request.js:132-134 const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL,An example of the parameters supplied to this request builder is:
js // src/api/search.js:59-62 const params = { _: Date.now(), token: token, };The same token parameter pattern is used by the search, post, comment, and trending API operations.
Technical Analysis
The private
GUAIKEI_API_TOKENis inserted into theparamsobject and serialized directly into the request URL. This occurs for both GET and POST requests, even though POST requests already have a JSON request body.HTTPS encrypts the complete request while it is in transit, but it does not prevent the request target from being recorded at either endpoint. URLs are commonly captured by web-server access logs, reverse proxies, API gateways, monitoring systems, tracing platforms, diagnostic tooling, and error reports. Placing a reusable credential in the query string therefore increases its exposure beyond the components that need to authenticate the request.
The request destination is statically restricted to
www.guaikei.com, so this is not an arbitrary-host credential exfiltration issue. Exploitation requires access to infrastructure or diagnostic records containing the request URL.Attack Path
- A user configures a valid
GUAIKEI_API_TOKEN. - One of the four C ...[truncated 988 chars]
- A user configures a valid
- Remediation
View remediation
Remediation Suggestions
-
Remove the token from every query-parameter object.
-
Send credentials in an HTTP authorization header, for example:
js headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", "Accept-Encoding": "identity", } -
Refactor
getJson,postJson, andrequestApito accept authentication separately from ordinary request parameters. -
Configure server, proxy, tracing, and application logs to redact
Authorization, token fields, and other authentication material. -
Ensure exception messages and debugging output never include complete request headers or URLs containing credentials.
-
Review existing server-side URL logs and rotate tokens that may already have been recorded.
-
Add automated tests asserting that generated request paths never contain
token,access_token, or equivalent credential fields.
-