T09 · Insecure Skill Coding Practices
- Location
src/utils/request.js:86- Finding
API Token Exposed in URL Query Strings
- Content
View full analysis
Vulnerability Details
File Location:
src/api/search.js:23-26,src/api/search.js:52-59,src/api/detail.js:20-23,src/api/detail.js:46-50,src/api/post.js:20-23,src/api/post.js:46-50,src/api/comment.js:20-23,src/api/comment.js:46-50,src/utils/request.js:86-98, andsrc/utils/request.js:108-119
Vulnerability Type: Sensitive credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
The API modules place
GUAIKEI_API_TOKENinto request parameter objects:js // src/api/search.js:23-26 return await postJson( "/api/xiaohongshu/note-search/keyword", { _: Date.now(), token: token }, { keyword, type, sort, time, limit }, );js // src/api/search.js:52-59 const res = await getJson("/api/xiaohongshu/note-search/info", { _: Date.now(), token: token, keyword, type, sort, time, limit, });The same credential-handling pattern appears in the detail, post, and comment APIs:
js // src/api/detail.js:20-23 return await postJson( "/api/xiaohongshu/detail/url", { _: Date.now(), token: token }, { url: url, limit: limit }, );js // src/api/detail.js:46-50 const res = await getJson("/api/xiaohongshu/detail/info", { _: Date.now(), token: token, url: url, limit: limit, });js // src/api/post.js:20-23 return await postJson( "/api/xiaohongshu/post/url", { _: Date.now(), token: token }, { url, limit }, );js // src/api/post.js:46-50 const res = await getJson("/api/xiaohongshu/post/info", { _: Date.now(), token: token, url, limit, });js // src/api/comment.js:20-23 return await postJson( "/api/xiaohongshu/comment/url", { _: Date.now(), token: token }, { url, limit }, );js // src/api/comment.js:46-50 const res = await getJson("/api/xiaohongshu/comme ...[truncated 3762 chars]- Remediation
View remediation
Remediation Suggestions
-
Remove
tokenfrom all query parameter objects in the search, detail, post, and comment modules. -
Pass the credential separately to the request helper and place it in an HTTP authorization header:
js const options = { host: constants.BASE_URL, path: fullPath, method: "POST", headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", "Content-Length": Buffer.byteLength(jsonData), }, }; -
Apply the same authorization-header mechanism to polling requests instead of authenticating through GET query parameters.
-
If the service does not support bearer authentication, introduce a dedicated secret-bearing header such as
X-API-Keyand update the server accordingly. -
Configure servers, gateways, proxies, tracing systems, and monitoring tools to redact
Authorization,X-API-Key, and legacytokenvalues. -
Avoid including complete request URLs in errors or diagnostics when they could contain credentials.
-
Rotate existing API tokens because historical infrastructure logs may already contain them.
-
Establish retention and access-control policies for any historical logs containing credential-bearing URLs.
-
Add automated tests that assert no API credential appears in
options.path, console output, saved result files, or error messages.
-