T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/geekbi_auth.py:698
- Finding
- Unrestricted API base URL permits authentication and sensitive requests to untrusted or cleartext endpoints<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/aliexpress_goods_search.py:56-62` - `scripts/aliexpress_goods_info.py:43-49` - `scripts/aliexpress_site_list.py:63-68` - `scripts/geekbi_auth.py:578-579` - `scripts/geekbi_auth.py:698-724` **Vulnerability Type**: Unrestricted authentication endpoint and insufficient transport validation **Risk Level**: High ### Vulnerable Code From `scripts/aliexpress_goods_search.py:56-62`: ```python parser.add_argument("--base-url", default=DEFAULT_BASE_URL) parser.add_argument("--param", action="append", default=[], help="查询条件，格式为 名称=值") parser.add_argument("--timeout", type=float, default=30) args = parser.parse_args() try: params = parse_params(args.param) payload = authenticated_json_request( build_url(args.base_url, ENDPOINT, params), args.base_url, args.timeout ) ``` Equivalent unrestricted `--base-url` arguments are also exposed by the product-information and site-list entry points. From `scripts/geekbi_auth.py:578-579`: ```python endpoint = f"{base_url.rstrip('/')}{TOKEN_ENDPOINT}" try: response = _post_json(endpoint, {"deviceCode": pending["deviceCode"]}, timeout) ``` From `scripts/geekbi_auth.py:698-724`: ```python def authenticated_json_request( url, base_url, timeout, *, method="GET", body=None, headers=None, ): complete_pending_login(base_url, timeout) request_headers = _api_headers() if headers: request_headers.update(headers) authorization = _authorization_header(base_url) if authorization: request_headers["token"] = authorization request = Request( url, data=body, headers=request_headers, method=method, ) try: with urlopen(request, timeout=timeout) as response: response_payload = _read_json_response(response) _raise_action_if_needed(response_payload) return response_payload ``` ### Technical Analysis All network- ...[truncated 2979 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `--base-url` from production-facing command-line interfaces and use the fixed HTTPS GeekBI endpoint. 2. If endpoint overrides are required for testing, place them behind an explicit development-only option that is disabled by default. 3. Parse the destination with `urllib.parse.urlsplit` and enforce: - `scheme == "https"` - An exact allowlist of approved hostnames - Approved ports only - No username or password component - No malformed or ambiguous hostname representation 4. Independently validate both the API base URL and every server-provided `jumpUrl`. 5. Restrict authorization URLs to approved HTTPS origins before displaying them to users. 6. Prevent sensitive headers from being forwarded across origins during redirects, or disable redirects and validate each redirect destination explicitly. 7. Bind persisted tokens to a normalized, validated origin rather than an unvalidated string. 8. Add tests proving that HTTP URLs, unknown hosts, embedded credentials, unusual ports, and cross-origin authorization URLs are rejected. ]]>