T09 · Insecure Skill Coding Practices
Error
- Location
scripts/trading_client.py:38- Finding
Authenticated API traffic can be sent to an arbitrary non-HTTPS platform endpoint
- Content
View full analysis
Vulnerability Details
File Location:
scripts/trading_client.py:38-44, 66-99
Vulnerability Type: Insufficient URL validation and insecure transport of sensitive API data
Risk Level: HighVulnerable Code
python self.base_url = str(base_url or "").rstrip("/") if not self.base_url: raise ValueError( "Platform base URL missing. Pass --platform-url explicitly or store " "base_url in agent_creds.json before using trading/verify features." ) parsed = urllib.parse.urlsplit(self.base_url) if parsed.path not in ("", "/"): raise ValueError( "Platform base URL must be the site origin only, for example " "'https://ai.moss.site'. The client appends the API prefix " "automatically and will request " "'https://ai.moss.site/api/v1/moss/agent/agents/bind' " "for bind." )python def _request(self, method: str, path: str, body: dict = None, query: dict = None, need_auth: bool = True, custom_prefix: str = None) -> dict: prefix = custom_prefix if custom_prefix is not None else API_PREFIX full_path = f"{prefix}{path}" url = f"{self.base_url}{full_path}" canonical_query = "" if query: sorted_params = sorted(query.items()) canonical_query = urllib.parse.urlencode(sorted_params) url = f"{url}?{canonical_query}" raw_body = "" if body is not None: raw_body = json.dumps(body, separators=(",", ":")) headers = dict(DEFAULT_HEADERS) if need_auth and self.api_key: ts, nonce, sig = self._sign(method, full_path, canonical_query, raw_body) headers["X-API-KEY"] = self.api_key headers["X-TS"] = ts headers["X-NONCE"] = nonce headers["X-SIGNATURE"] = sig if self.bot_id and path in ACCOUNT_BOUND_PATHS: headers["X-BOT-ID"] = self.bot_id req = urllib. ...[truncated 2937 chars]- Remediation
View remediation
Remediation Suggestions
- Require
parsed.scheme == "https"for all authenticated, binding, upload, and trading operations. - Reject URLs containing user information, fragments, unexpected query strings, or non-approved ports.
- Prefer an explicit allowlist containing the declared platform hostname. If custom enterprise endpoints are required, place them behind a separate opt-in setting with a clear warning.
- Disable automatic redirects for authenticated requests, or revalidate every redirect destination and prohibit cross-origin redirects.
- Never forward API headers or request bodies to a redirected origin.
- Validate TLS certificates using the system trust store and do not provide an option to disable certificate verification.
- Consider binding credentials to the expected platform origin and reject a credential file whose stored origin differs from the requested origin.
- Require