T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:76- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:76-112, with vulnerable callers insrc/api/search.js:20-60,src/api/detail.js:17-51,src/api/comment.js:17-51, andsrc/api/post.js:17-51
Vulnerability Type: API credential exposure through request URLs
Risk Level: MediumVulnerable Code
js async function postJson(path, params, data) { if (!path || typeof path !== "string") { throw new Error("path 必须是非空字符串"); } if (!params || typeof params !== "object") { throw new Error("params 必须是对象"); } if (!data || typeof data !== "object") { throw new Error("data 必须是对象"); } params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(jsonData), }, }; return await request(options, jsonData); } async function getJson(path, params) { if (!path || typeof path !== "string") { throw new Error("path 必须是非空字符串"); } if (!params || typeof params !== "object") { throw new Error("params 必须是对象"); } params._ = Date.now(); const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Content-Type": "application/json", }, }; return await request(options); }The API modules pass the raw credential in the
paramsobject. For example:js return await postJson( "/api/xiaohongshu/detail/url", { _: Date.now(), token: token }, { url: url, limit: limit }, );js const res = await getJson("/api/xiaohongshu/detail/info", { _: Date.now(), token: token, url: url, limit: limit, ...[truncated 1894 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove the
tokenproperty from all URL query parameter objects. -
Send credentials in an authorization header, for example:
js headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json", } -
Refactor
postJsonandgetJsonto accept authentication separately from ordinary request parameters so credentials cannot accidentally be serialized into URLs. -
Redact tokens from application errors, tracing data, debug output, and server telemetry.
-
Configure reverse proxies and API servers to suppress or sanitize sensitive query parameters while legacy clients remain supported.
-
Rotate any tokens that may already have been retained in URL or infrastructure logs.
-
Add automated tests that fail if
token,api_key, or authorization credentials appear in generated request paths.
-