T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/aliexpress_goods_search.py:54
- Finding
- Caller-Controlled Base URL Permits Plaintext Authentication Traffic and Unrestricted Credential Destinations## Vulnerability Details **File Location**: `scripts/aliexpress_goods_search.py:54-64` and equivalent `--base-url` handling in the category and site scripts; request behavior is implemented in `scripts/geekbi_auth.py:698-721` **Vulnerability Type**: Unvalidated authentication endpoint and insecure transport **Risk Level**: High ### Complete Code Snippet ```python def main(): parser = argparse.ArgumentParser(description="Query AliExpress goods and output JSON") parser.add_argument("--base-url", default=DEFAULT_BASE_URL) parser.add_argument("--param", action="append", default=[], help="Query parameter") parser.add_argument("--timeout", type=float, default=30) args = parser.parse_args() try: params = parse_params(args.param) payload = authenticated_json_request( build_url(args.base_url, ENDPOINT, params), args.base_url, args.timeout ) ``` ```python def authenticated_json_request( url, base_url, timeout, *, method="GET", body=None, headers=None, ): complete_pending_login(base_url, timeout) request_headers = _api_headers() if headers: request_headers.update(headers) authorization = _authorization_header(base_url) if authorization: request_headers["token"] = authorization request = Request( url, data=body, headers=request_headers, method=method, ) try: with urlopen(request, timeout=timeout) as response: response_payload = _read_json_response(response) ``` ### Technical Analysis Every business script exposes `--base-url` directly to the caller. The value is concatenated with API paths and passed into the authentication subsystem without scheme, hostname, port, or origin validation. Authentication state is keyed by that caller-controlled value. Once an authentication challenge has been c ...[truncated 2163 chars]
- Remediation
- ## Remediation Suggestions - Remove `--base-url` from production-facing scripts unless alternate servers are essential. - If configurability is required, parse the URL with `urllib.parse.urlsplit` and require: - `scheme == "https"`; - an exact hostname allowlist; - approved ports only; - no embedded username or password; - no fragments or unexpected path prefixes. - Bind credentials to a normalized origin tuple rather than an unvalidated string. - Refuse to attach authentication headers when the request URL and authenticated origin differ. - Disable or strictly validate redirects for authenticated requests; never forward authentication headers across origins or to a downgraded HTTP destination. - Use a separate explicit development option for localhost testing, with authentication disabled or isolated credentials. - Add tests covering HTTP rejection, lookalike domains, user-info URLs, cross-origin redirects, alternate ports, and hostname normalization.