T09 · Insecure Skill Coding Practices
- Location
if_netchange.py:48- Finding
Unauthenticated Market Data Retrieval and Disabled TLS Verification
- Content
View full analysis
Vulnerability Details
File Location:
if_netchange.py:48-60
Vulnerability Type: Insecure network transport and certificate validation
Risk Level: MediumComplete Code Snippet
python CTX = ssl.create_default_context(); CTX.check_hostname = False; CTX.verify_mode = ssl.CERT_NONE # ---------- CFFEX download ---------- def cffex_url(date8, product): return f"http://www.cffex.com.cn/sj/ccpm/{date8[:6]}/{date8[6:]}/{product}.xml?id={random.randint(1,99)}" def download(product, date8, save_path): try: req = urllib.request.Request(cffex_url(date8, product), headers={ "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Referer": "http://www.cffex.com.cn/cn/ccpm.html"}) data = urllib.request.urlopen(req, timeout=30, context=CTX).read() if b'<positionRank' not in data[:600]: raise ValueError("Returned content is not position XML (possibly 404/empty)")The same insecure context and plaintext endpoint are also used by the availability check at
if_netchange.py:75-80.Technical Analysis
Position data is retrieved over plaintext HTTP, which provides neither server authentication nor transport integrity. The code also creates an SSL context that explicitly disables hostname checking and certificate verification. Although the current URLs use HTTP, retaining this context means changing the endpoint to HTTPS without removing these settings would still leave the connection vulnerable to interception.
Response validation only checks whether the first 600 bytes contain the marker
<positionRank. This verifies neither the origin nor the integrity of the XML. An attacker can therefore create a forged document that passes the check. The forged response is written into the local cache and later parsed as authoritative market data.The downloaded XML is treated as data rather than executable code, so the identified path does ...[truncated 1313 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace all CFFEX URLs with authenticated HTTPS endpoints, including both data URLs and the
Referervalue:python def cffex_url(date8, product): return ( f"https://www.cffex.com.cn/sj/ccpm/" f"{date8[:6]}/{date8[6:]}/{product}.xml" f"?id={random.randint(1, 99)}" ) -
Remove the custom context that disables verification. Use Python's default TLS behavior:
python data = urllib.request.urlopen(req, timeout=30).read()Alternatively, retain a default context without modifying
check_hostnameorverify_mode:python CTX = ssl.create_default_context() -
Apply the same correction to
data_available()so every network request receives equivalent protection. -
Strengthen semantic validation before caching:
- Require the root element to be
positionRank. - Verify
tradingdayequals the requested date. - Verify
productidand contract prefixes match the requested product. - Reject malformed, missing, duplicate, or unreasonable numeric fields.
- Enforce a reasonable maximum response size.
- Require the root element to be
-
Download to a temporary file in the cache directory, validate it completely, flush it, and atomically replace the existing cache file only after successful validation. This prevents invalid responses from replacing known-good cached data.
-
If CFFEX publishes checksums, signatures, or another authenticated data interface, verify the downloaded data against that mechanism before using it in reports.
-