T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:76- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:76-96, 101-119; credential parameters originate fromsrc/api/search.js:20-28, 49-61,src/api/detail.js:17-25, 43-52,src/api/comment.js:17-25, 43-52, andsrc/api/post.js:17-25, 43-52
Vulnerability Type: API credential exposure through query strings
Risk Level: MediumVulnerable Code
src/utils/request.js:76-96:js async function postJson(path, params, data) { if (!path || typeof path !== "string") { throw new Error("path must be a non-empty string"); } if (!params || typeof params !== "object") { throw new Error("params must be an object"); } if (!data || typeof data !== "object") { throw new Error("data must be an object"); } params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(jsonData), }, }; return await request(options, jsonData); }src/utils/request.js:101-119:js async function getJson(path, params) { if (!path || typeof path !== "string") { throw new Error("path must be a non-empty string"); } if (!params || typeof params !== "object") { throw new Error("params must be an object"); } params._ = Date.now(); const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Content-Type": "application/json", }, }; return await request(options); }Representative credential source in
src/api/detail.js:17-25, 43-52:js async function createDetailTask(token, url, limit) { return await withRetry( ...[truncated 2664 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove
tokenfrom all query-parameter objects. -
Pass the token in an HTTP authorization header, preferably using a standard scheme:
js headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json", } -
Refactor
getJsonandpostJsonto accept authentication separately from ordinary request parameters. -
Ensure server, proxy, gateway, and telemetry configurations redact authorization headers and any legacy
tokenquery parameter. -
Rotate credentials that may already have appeared in operational logs.
-
Define token expiration, revocation, and least-privilege policies.
-
Add automated tests that fail if sensitive parameter names such as
token,api_key, orsecretappear in generated request URLs.
-