T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/geekbi_auth.py:698
- Finding
- Unrestricted API Base URL Allows Sensitive Authentication Data to Be Sent to Untrusted Hosts<![CDATA[ ## Vulnerability Details **File Location**: `scripts/geekbi_auth.py:698-721`; exposed through `scripts/shopee_goods_search.py:58-67`, `scripts/shopee_goods_info.py:35-42`, and `scripts/shopee_site_list.py:77-83` **Vulnerability Type**: Unvalidated authentication destination and insecure transport **Risk Level**: High ### Complete Vulnerable Code Snippet ```python def authenticated_json_request( url, base_url, timeout, *, method="GET", body=None, headers=None, ): complete_pending_login(base_url, timeout) request_headers = _api_headers() if headers: request_headers.update(headers) authorization = _authorization_header(base_url) if authorization: request_headers["token"] = authorization request = Request( url, data=body, headers=request_headers, method=method, ) try: with urlopen(request, timeout=timeout) as response: response_payload = _read_json_response(response) _raise_action_if_needed(response_payload) return response_payload ``` The authentication exchange uses the same unrestricted base URL: ```python endpoint = f"{base_url.rstrip('/')}{TOKEN_ENDPOINT}" try: response = _post_json( endpoint, {"deviceCode": pending["deviceCode"]}, timeout, ) ``` Each business command exposes that value directly to the caller. For example: ```python parser.add_argument("--base-url", default=DEFAULT_BASE_URL) parser.add_argument("--param", action="append", default=[], help="查询条件，格式为 名称=值") parser.add_argument("--timeout", type=float, default=30) args = parser.parse_args() try: params = parse_params(args.param) payload = authenticated_json_request( build_url(args.base_url, ENDPOINT, params), args.base_url, args.timeout ) ``` Equivalent unrestricted `--base-url` arguments are present in the product-detail and site-list commands. ### Technical Analysis The defaul ...[truncated 3251 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `--base-url` from production-facing commands if endpoint customization is not essential. 2. If customization is required, enforce an explicit allowlist of complete origins, such as exactly `https://openapi.geekbi.com`. 3. Parse URLs with `urllib.parse.urlsplit()` and reject: - Any scheme other than HTTPS; - Unexpected hostnames or ports; - Embedded user information; - Fragments or malformed authority components. 4. Build API URLs from a validated origin rather than concatenating raw strings. 5. Validate `jumpUrl` separately and only display links using an approved HTTPS origin. 6. Ensure redirects cannot cause authentication headers or device codes to be forwarded to a different origin. Prefer disabling redirects for authenticated requests or validating every redirect destination. 7. Separate test endpoint support from production code. Test overrides should require an explicit development mode and should not have access to production authentication state. 8. Add automated tests covering HTTP URLs, attacker-controlled hosts, malformed URLs, alternate ports, user-information tricks, and cross-origin redirects. ]]>