T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:85- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:85-89, 108-113; credential parameters originate fromsrc/api/search.js:23-26, 52-59,src/api/detail.js:20-24, 46-52, andsrc/api/comment.js:20-24, 46-51
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
js // src/utils/request.js:85-89 params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL,js // src/utils/request.js:108-113 params._ = Date.now(); const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL, path: fullPath,The API modules supply the secret token as part of the parameter object:
js // src/api/search.js:23-26 return await postJson( "/api/xiaohongshu/note-search/keyword", { _: Date.now(), token: token }, { keyword, type, sort, time, limit }, );js // src/api/search.js:52-59 const res = await getJson("/api/xiaohongshu/note-search/info", { _: Date.now(), token: token, keyword, type, sort, time, limit, });Technical Analysis
GUAIKEI_API_TOKENis passed topostJsonandgetJsonin theparamsobject. Both functions serialize that object into the HTTP request target usingquerystring.stringify, producing URLs such as:text /api/xiaohongshu/note-search/info?token=REDACTED&keyword=exampleHTTPS protects the request from passive interception in transit, but it does not prevent the request target from being recorded by the destination server, reverse proxies, load balancers, web application firewalls, monitoring systems, or diagnostic tooling. The polling implementation can place the same credential into many request records.
Authentication credentials should not be transmitted ...[truncated 1192 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove
tokenfrom every query-parameter object. -
Transmit the credential using an authorization header, for example:
js const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}`, }, }; -
Refactor
postJsonandgetJsonso authentication is accepted separately from ordinary request parameters. -
Configure the server, proxy, monitoring, and error-reporting layers to redact authorization headers and sensitive query keys.
-
Rotate API tokens that have already been transmitted in URLs.
-
Add automated tests that fail if
token,secret, or authorization values appear in a generated request path. -
Avoid documentation commands that print the token directly. Replace
echo $GUAIKEI_API_TOKENwith a non-disclosing presence and format check.
-