T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:66- Finding
API Credential Transmitted in URL Query Strings
- Content
View full analysis
{ return await postJson( "/api/xiaohongshu/detail/url", { _: Date.now(), token: token }, { url: url, limit: limit }, ); }, ``` ```js // src/api/detail.js:45-51 async () => { const res = await getJson("/api/xiaohongshu/detail/info", { _: Date.now(), token: token, url: url, limit: limit, }); ``` ```js // src/utils/request.js:66-98 async function postJson(path, params, data) { if (!path || typeof path !== "string") { throw new Error("path must be a non-empty string"); } if (!params || typeof params !== "object") { throw new Error("params must be an object"); } if (!data || typeof data !== "object") { throw new Error("data must be an object"); } params.skill_name = skillName(); const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(jsonData), }, }; return await request(options, jsonData); } ``` ```js // src/utils/request.js:101-119 async function getJson(path, params) { if (!path || typeof path !== "string") { throw new Error("path must be a non-empty string"); } if (!params || typeof params !== "object") { throw new Error("params must be an object"); } params._ = Date.now(); const fullPath = `${path}?${querystring.stringify(params)}`; con ...[truncated 2212 chars]- Remediation
View remediation