T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:76- Finding
API Credential Transmitted in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:76-98, with credential-bearing parameters supplied bysrc/api/search.js:20-28,src/api/detail.js:17-25,src/api/comment.js:17-25, andsrc/api/post.js:17-25
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
src/utils/request.js:76-98:js async function postJson(path, params, data) { if (!path || typeof path !== "string") { throw new Error("path must be a non-empty string"); } if (!params || typeof params !== "object") { throw new Error("params must be an object"); } if (!data || typeof data !== "object") { throw new Error("data must be an object"); } params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(jsonData), }, }; return await request(options, jsonData); }src/api/search.js:20-28demonstrates how the token enters those parameters:js async function createSearchTask(token, keyword, type, sort, time, limit) { return await withRetry( async () => { return await postJson( "/api/xiaohongshu/note-search/keyword", { _: Date.now(), token: token }, { keyword, type, sort, time, limit }, ); },The same credential-passing pattern is used by the detail, comment, and creator-post APIs. Polling GET requests also put the token into the query object before
getJsonconstructs the request URL.Technical Analysis
GUAIKEI_API_TOKENis inserted into the query string of every task-creation and task-polling request. HTTPS protects the request while it is in transit, but ...[truncated 1702 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove
tokenfrom all query-parameter objects. -
Send the credential in an authorization header, for example:
js headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json", "Content-Length": Buffer.byteLength(jsonData), } -
Refactor
postJsonandgetJsonto accept the token separately from ordinary request parameters so callers cannot accidentally serialize it into the URL. -
Ensure client, proxy, gateway, server, and monitoring logs redact authorization data.
-
Rotate existing tokens because historical infrastructure logs may already contain them.
-
Apply short token lifetimes, revocation support, rate limits, and least-privilege scopes where supported by the service.
-
Add automated tests that assert generated request paths never contain
token=, API keys, or authorization secrets.
-