T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:87- Finding
API Token Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/api/search.js:23-26, 52-59;src/api/detail.js:20-23, 46-50;src/api/comment.js:20-23, 46-50;src/api/post.js:20-23, 46-50;src/utils/request.js:87-92, 110-115
Vulnerability Type: Sensitive credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
The API modules add the token to the request parameter object:
js return await postJson( "/api/xiaohongshu/note-search/keyword", { _: Date.now(), token: token }, { keyword, type, sort, time, limit }, );js const res = await getJson("/api/xiaohongshu/note-search/info", { _: Date.now(), token: token, keyword, type, sort, time, limit, });The shared request utility then serializes all parameters, including the token, into the URL:
js params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(jsonData), }, };js params._ = Date.now(); const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Content-Type": "application/json", }, };Technical Analysis
The
GUAIKEI_API_TOKENis an authentication credential, but every API method places it in a URL query string. HTTPS encrypts the request while it is in transit; however, it does not prevent the complete URL from being recorded after TLS termination.Request URLs are routinely captured by reverse-proxy access logs, API gateways, web-server logs, observability platforms, tracing systems, security appliances, and server-side error reports. Query parameters may also be ret ...[truncated 1307 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the token from all query-parameter objects in
src/api/search.js,src/api/detail.js,src/api/comment.js, andsrc/api/post.js. - Pass the credential through a dedicated authorization header, preferably:
js headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json" } - Refactor
getJsonandpostJsonto accept authentication separately from ordinary request parameters so credentials cannot be accidentally serialized into URLs. - Ensure authorization headers are redacted from application logs, traces, exception reports, and debugging output.
- Review proxy, API gateway, server, and observability logs for previously recorded tokens. Restrict access to those logs and shorten their retention where appropriate.
- Rotate any token that may already have appeared in URL logs.
- Add automated tests asserting that generated request paths never contain
token,api_key, or other secret-bearing parameters.
- Remove the token from all query-parameter objects in