T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:87- Finding
API Credential Exposed in HTTPS URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:76-119; credential parameters originate fromsrc/api/search.js:23-26,52-59,src/api/detail.js:20-23,46-50,src/api/post.js:20-23,46-50, andsrc/api/comment.js:20-23,46-50
Vulnerability Type: Authentication credential disclosure through URL query parameters
Risk Level: MediumVulnerable Code
Credential-bearing parameters are serialized directly into request URLs:
js async function postJson(path, params, data) { if (!path || typeof path !== "string") { throw new Error("path must be a non-empty string"); } if (!params || typeof params !== "object") { throw new Error("params must be an object"); } if (!data || typeof data !== "object") { throw new Error("data must be an object"); } params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(jsonData), }, }; return await request(options, jsonData); } async function getJson(path, params) { if (!path || typeof path !== "string") { throw new Error("path must be a non-empty string"); } if (!params || typeof params !== "object") { throw new Error("params must be an object"); } params._ = Date.now(); const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Content-Type": "application/json", }, }; return await request(options); }Every API module supplies the token as one of these query parameters. For example:
js async function createDetailTask(token, url, limit) { return await ...[truncated 2826 chars]- Remediation
View remediation
Remediation Suggestions
- Remove
tokenfrom all query-parameter objects. - Transmit the credential in an authentication header, preferably:
js headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json" } - Refactor
postJsonandgetJsonso credentials are accepted separately from ordinary query parameters and cannot be serialized into a URL accidentally. - Configure servers, proxies, and monitoring systems to redact authorization data and sensitive Xiaohongshu URL parameters.
- Add automated tests asserting that generated request paths never contain
token,api_key, or similar credential names. - Rotate credentials previously used by affected versions if infrastructure URL logs may have been accessible to unauthorized parties.
- Apply short token lifetimes, least-privilege scopes, rate limits, and server-side revocation support to reduce the impact of future exposure.
- Remove