T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate.py:11- Finding
API Credentials and Database Metadata Transmitted over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate.py, lines 11 and 13–25; sensitive request construction occurs at lines 84–88
Vulnerability Type: Plaintext transmission of credentials and potentially sensitive database metadata
Risk Level: HighVulnerable Code
python API_BASE = os.environ.get("SQL_API_URL", "http://47.109.39.255:8765/api/v4") USER_KEY = os.environ.get("SQL_API_USER_KEY", "") def api_call(endpoint, data=None, method="POST"): url = f"{API_BASE.rstrip('/')}/{endpoint}" h = {"Content-Type": "application/json"} if USER_KEY: h["X-User-Key"] = USER_KEY try: if method == "GET": resp = requests.get(url, headers=h, params=data or {}, timeout=30) else: resp = requests.post(url, headers=h, json=data or {}, timeout=60) if resp.status_code >= 400: try: err = resp.json() msg = err.get("detail", str(err)) except: msg = resp.text print(f"❌ API错误 ({resp.status_code}): {msg}", file=sys.stderr) if resp.status_code == 402: print("\n💡 余额不足！充值请联系微信 17392371127", file=sys.stderr) sys.exit(1) return resp.json() except Exception as e: print(f"❌ 网络错误: {str(e)}", file=sys.stderr) sys.exit(1)python data = {} data['query'] = args.query if args.schema: data['schema'] = args.schema if args.db: data['db_type'] = args.db result = api_call("sql-generator", data)Technical Analysis
The default API endpoint uses unencrypted HTTP rather than HTTPS. The client places
SQL_API_USER_KEYin theX-User-Keyrequest header and transmits the user's natural-language query and optional database schema in the request body.HTTP provides neither transport confidentiality nor server authentication. An attacker with visibility or control ...[truncated 2012 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the plaintext endpoint with an HTTPS endpoint on a verified domain:
python API_BASE = os.environ.get( "SQL_API_URL", "https://api.example.com/api/v4" ) - Parse and validate
SQL_API_URLat startup and reject any scheme other thanhttps. - Do not permit cleartext fallback when TLS negotiation fails.
- Use a valid certificate chain and retain normal certificate and hostname verification.
- Rotate any API keys that may already have been transmitted over the plaintext endpoint.
- Minimize submitted schema data and warn users not to include credentials, records, connection strings, or unnecessary internal metadata.
- Obtain explicit user approval before transmitting schema details to an external service.
- Consider short-lived, narrowly scoped tokens instead of reusable static user keys.
- Treat remote SQL output as untrusted. Display a clear warning and recommend review, transaction controls, least-privileged database accounts, and testing before execution.
- Add automated tests that fail if the default endpoint or any accepted override uses HTTP.
- Replace the plaintext endpoint with an HTTPS endpoint on a verified domain: