T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:71- Finding
API Credential Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/utils/request.js:71-92, with credential sources insrc/api/search.js:20-29,49-60,src/api/detail.js:17-26,43-52, andsrc/api/post.js:17-26,43-52
Vulnerability Type: Credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
src/utils/request.js:71-92:js async function postJson(path, params, data) { if (!path || typeof path !== "string") { throw new Error("path must be a non-empty string"); } if (!params || typeof params !== "object") { throw new Error("params must be an object"); } if (!data || typeof data !== "object") { throw new Error("data must be an object"); } const fullPath = `${path}?${querystring.stringify(params)}`; const jsonData = JSON.stringify(data); const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(jsonData), }, }; return await request(options, jsonData); }src/utils/request.js:95-113:js async function getJson(path, params) { if (!path || typeof path !== "string") { throw new Error("path must be a non-empty string"); } if (!params || typeof params !== "object") { throw new Error("params must be an object"); } params._ = Date.now(); const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Content-Type": "application/json", }, }; return await request(options); }A representative credential source appears in
src/api/search.js:20-29:js async function createSearchTask(token, keyword, type, sort, time, limit) { return await withRetry( async () => { return await postJson( "/api/xiao ...[truncated 2496 chars]- Remediation
View remediation
Remediation Suggestions
- Remove the token from every query-parameter object.
- Transmit it through a dedicated authentication header, preferably:
js headers: { "Authorization": `Bearer ${token}`, "Content-Type": "application/json", } - Refactor
postJsonandgetJsonto accept authentication separately from ordinary request parameters, preventing accidental serialization of secrets into URLs. - Configure client, server, proxy, and monitoring systems to redact
Authorizationand any legacytokenparameter. - Rotate tokens that may already have appeared in access or monitoring logs.
- Review and purge retained URL logs containing credentials where operationally and legally appropriate.
- Add automated tests asserting that request paths never contain
token,secret,password, or authorization credential values.