T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ftp-api.mjs:94- Finding
TLS Certificate Validation Is Disabled for Proxy Requests
- Content
View full analysis
{ const url = new URL(apiUrl); const isHttps = url.protocol === "https:"; const transport = isHttps ? https : http; const jsonData = JSON.stringify(body); const headers = { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(jsonData), }; if (apiKey) { headers["X-API-Key"] = apiKey; } const options = { hostname: url.hostname, port: url.port || (isHttps ? 443 : 80), path: url.pathname + url.search, method: "POST", headers: headers, rejectUnauthorized: false, // 允许自签证书 }; const req = transport.request(options, (res) => { const chunks = []; res.on("data", (chunk) => chunks.push(chunk)); res.on("end", () => { const raw = Buffer.concat(chunks).toString("utf-8"); try { const json = JSON.parse(raw); resolve(json); } catch { reject(new Error(`PHP 代理返回非 JSON 响应 (HTTP ${res.statusCode}):\n${raw.substring(0, 500)}`)); } }); }); req.on("error", (e) => reject(new Error(`请求 PHP 代理失败: ${e.message}`))); req.setTimeout(120000, () => { req.destroy(); reject(new Error("请求 PHP 代理超时 (120s)")); }); req.write(jsonData); req.end(); }); } ``` The same `rejectUnauthorized: false` setting is also present in the multipart request at lines 178-185 and the raw-download request at lines 229-236. ### Technical Analysis Setting `rejectUnauthorized` to `false` disables validation of the HTTPS server's certificate chain and hostname. Consequently, encryption alone does not authentic ...[truncated 1832 chars]- Remediation
View remediation