T09 · Insecure Skill Coding Practices
Error
- Location
scripts/news.js:20- Finding
API key disclosure through an unrestricted and potentially plaintext endpoint override
- Content
View full analysis
{ const protocol = url.protocol === 'https:' ? https : http; const req = protocol.request(url, { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-API-Key': API_KEY, }, }, (res) => { let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => { try { const json = JSON.parse(data); if (json.code !== 0) { reject(new Error(`API错误 [${json.code}]: ${json.msg}`)); } else { resolve(json.data); } } catch (e) { reject(new Error(`响应解析失败: ${e.message}`)); } }); }); req.on('error', reject); req.write(bodyStr); req.end(); }); } ``` ### Technical Analysis The script obtains the sensitive `JRJ_API_KEY` credential from the environment and sends it in the `X-API-Key` header. Sending this key to the official service is necessary for the declared financial-news search functionality. However, the destination is controlled by the undocumented `JRJ_API_URL` environment variable. The implementation does not verify the destination hostname, port, or transport security before attaching the credential. It also explicitly selects Node.js's plaintext `http` module whenever the configured URL does not use HTTPS. Consequently, a process-environment value can redirect both the API k ...[truncated 2368 chars]- Remediation
View remediation