T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:83- Finding
API Credential Exposed in HTTP Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:83-109; credential parameters originate fromsrc/api/comment.js:20-23,46-50,src/api/detail.js:20-23,46-50,src/api/post.js:20-23,46-50, andsrc/api/search.js:23-26,52-59
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
The shared HTTP helpers serialize all parameters, including the API token, into the request URL:
js async function postJson(path, params, data) { if (!path || typeof path !== "string") { throw new Error("path 必须是非空字符串"); } if (!params || typeof params !== "object") { throw new Error("params 必须是对象"); } if (!data || typeof data !== "object") { throw new Error("data 必须是对象"); } params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(jsonData), }, }; return await request(options, jsonData); } async function getJson(path, params) { if (!path || typeof path !== "string") { throw new Error("path 必须是非空字符串"); } if (!params || typeof params !== "object") { throw new Error("params 必须是对象"); } params._ = Date.now(); const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Content-Type": "application/json", }, }; return await request(options); }For example, the search API explicitly supplies the credential as a query parameter for both task creation and result retrieval:
js return await postJson( "/api/xiaohongshu/note-search/keyword", { _: Date.now ...[truncated 2633 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove
tokenfrom every query parameter object in the API modules. -
Pass the credential through a standard authorization header, for example:
js const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}`, }, }; -
Refactor
getJsonandpostJsonto accept authentication separately from ordinary request parameters, preventing callers from accidentally placing secrets in URLs. -
Configure the API server, reverse proxies, gateways, and monitoring systems to redact authorization data and sensitive query parameters.
-
Avoid logging complete request headers or URLs in application errors and diagnostic traces.
-
Rotate credentials that have previously been transmitted in query strings because they may already exist in historical logs.
-
Apply least-privilege scopes, expiration periods, quotas, and revocation controls to API tokens.
-
Add automated tests asserting that generated request paths never contain
token,api_key,authorization, or other credential fields.
-