T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:72- Finding
API Token Transmitted in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:72-99; token-bearing parameters originate fromsrc/api/search.js:23-25,52-54,src/api/detail.js:20-22,46-48,src/api/comment.js:20-22,46-48, andsrc/api/post.js:20-22,46-48
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
js async function postJson(path, params, data) { if (!path || typeof path !== "string") { throw new Error("path must be a non-empty string"); } if (!params || typeof params !== "object") { throw new Error("params must be an object"); } if (!data || typeof data !== "object") { throw new Error("data must be an object"); } params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(jsonData), }, }; return await request(options, jsonData); }A representative caller explicitly places the API token in
params:js return await postJson( "/api/xiaohongshu/note-search/keyword", { _: Date.now(), token: token }, { keyword, type, sort, time, limit }, );The same behavior occurs for GET polling requests:
js const res = await getJson("/api/xiaohongshu/note-search/info", { _: Date.now(), token: token, keyword, type, sort, time, limit, });Technical Analysis
postJsonandgetJsonserialize all parameter properties into the request URL. Because each API caller includestoken, the value ofGUAIKEI_API_TOKENbecomes part of every outbound URL.HTTPS protects the URL from passive network interception while it is in transit, but it does not prevent the complete reque ...[truncated 1383 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove
tokenfrom every query-parameter object. -
Transmit the credential through an authorization header, such as:
js headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json", } -
If the service does not support bearer authentication, transmit the credential in the HTTPS request body rather than the URL and update the server accordingly.
-
Configure API gateways, reverse proxies, observability platforms, and application logs to redact tokens and sensitive query parameters.
-
Avoid including complete request URLs in exceptions or diagnostic output.
-
Rotate tokens that have already been transmitted through query strings, particularly if infrastructure logs may be broadly accessible.
-
Add automated tests that assert authentication credentials never appear in constructed request paths.
-