T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib/sources/arxiv.py:13- Finding
Academic search queries are transmitted over plaintext HTTP
- Content
View full analysis
list[Paper]: """搜索 arXiv""" params = { "search_query": f"all:{query}", "start": 0, "max_results": min(limit, 100), "sortBy": "relevance", "sortOrder": "descending", } xml_text = get_text(BASE_URL, params=params, timeout=20) if not xml_text: return [] return _parse_response(xml_text) ``` ### Technical Analysis The arXiv adapter sends the user-provided research query to an `http://` endpoint. Because HTTP does not provide transport encryption, server authentication, or response integrity, anyone able to observe or modify the network connection can inspect the research topic or alter the returned XML. The returned response is parsed into trusted-looking paper records and displayed to the user. A man-in-the-middle attacker could therefore inject fabricated titles, authors, abstracts, links, or identifiers into search and review results. The `http://` namespace strings used for XML parsing are namespace identifiers and are not themselves network requests. The vulnerability is specifically the plaintext `BASE_URL`. ### Attack Path 1. A user invokes `search`, `review`, or another operation that queries arXiv. 2. The user-controlled query is placed in the `search_query` URL parameter. 3. PaperCash transmits the request to `http://export.arxiv.org/api/query`. 4. An attacker controlling or monitoring the local network, proxy, gateway, or DNS path intercepts the plaintext request. 5. The attacker reads the research query or modifies the XML response. 6. PaperCash parses ...[truncated 503 chars]- Remediation
View remediation