T09 · Insecure Skill Coding Practices
Warning
- Location
src/api/search.js:20- Finding
API Credential Transmitted in URL Query Parameters
- Content
View full analysis
{ return await postJson( "/api/xiaohongshu/note-search/keyword", { _: Date.now(), token: token }, { keyword, type, sort, time, limit }, ); }, ``` The HTTP helper serializes this object directly into the request URL: ```javascript async function postJson(path, params, data) { if (!path || typeof path !== "string") { throw new Error("path 必须是非空字符串"); } if (!params || typeof params !== "object") { throw new Error("params 必须是对象"); } if (!data || typeof data !== "object") { throw new Error("data 必须是对象"); } params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(jsonData), }, }; return await request(options, jsonData); } ``` The destination is fixed in `src/config/constants.js`: ```javascript module.exports = { BASE_URL: "www.guaikei.com", REQUEST_TIMEOUT: 20000, CREATE_MAX_ATTEMPTS: 3, QUERY_MAX_ATTEMPTS: 20, RETRY_INTERVAL: 2000, VERSION: "1.1.1", }; ``` ### Technical Analysis The value of `GUAIKEI_API_TOKEN` is placed in the query string of every API request. Although the requests use HTTPS and the fixed destination `www.guaikei.com`, HTTPS does not prevent the complete URL from being recorded after TLS termination. Query strings are commonly retained by: ...[truncated 1915 chars]- Remediation
View remediation