T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/analyser.py:117
- Finding
- Financial market data retrieved over unencrypted HTTP## Vulnerability Details **File Location**: `scripts/analyser.py`, lines 117-142 **Vulnerability Type**: Plaintext HTTP transport for externally sourced financial data **Risk Level**: Medium ### Vulnerable Code ```python def fetch_dragon_tiger(self, date: str = None) -> List[Dict]: """获取龙虎榜数据""" if not date: date = datetime.now().strftime("%Y%m%d") url = f"http://datacenter-web.eastmoney.com/api/data/v1/get" params = { "sortColumns": "NET_BUY_AMT", "sortTypes": "-1", "pageSize": "50", "pageNumber": "1", "reportName": "RPT_DMSK_TS", "columns": "ALL", "filter": f"(TRADE_DATE='{date}')" } try: resp = self.session.get(url, params=params, timeout=10) data = resp.json() return data.get("result", {}).get("data", []) except: return [] ``` ### Technical Analysis The `fetch_dragon_tiger` method retrieves financial ranking data through plaintext HTTP. HTTP provides neither server authentication nor transport integrity. A network-positioned attacker can therefore intercept the request and modify the response before it reaches the application. The method immediately parses the response as JSON and returns the embedded records without checking the final URL, validating a cryptographic signature, verifying the response schema, or applying reasonable value constraints. Consequently, a forged but syntactically valid JSON response would be treated as legitimate financial data. This method was not found in the normal monitoring loop, which reduces immediate exposure. However, it remains an exposed part of the analysis engine and could be used directly or integrated into the monitoring workflow later. ### Attack Path 1. A user or application component invokes `fetch_dragon_tiger`. 2. The Skill sends an unencrypted HTTP request to the external financial-data endpoint. 3. A ...[truncated 927 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the HTTP endpoint with its verified HTTPS equivalent: ```python url = "https://datacenter-web.eastmoney.com/api/data/v1/get" ``` 2. Preserve TLS certificate verification and do not use `verify=False`. 3. Reject redirects that downgrade the connection from HTTPS to HTTP. 4. Call `resp.raise_for_status()` before parsing the response. 5. Verify that the response content type is JSON. 6. Validate the response against an explicit schema, including expected field names, types, date formats, and numerical ranges. 7. Log transport and validation failures without silently treating malformed responses as valid empty datasets. 8. If the provider does not support HTTPS, replace it with a trusted provider that offers authenticated transport.