T09 · Insecure Skill Coding Practices
- Location
scripts/analyser.py:117- Finding
Financial market data retrieved over unencrypted HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/analyser.py, lines 117-142
Vulnerability Type: Plaintext HTTP transport for externally sourced financial data
Risk Level: MediumVulnerable Code
python def fetch_dragon_tiger(self, date: str = None) -> List[Dict]: """获取龙虎榜数据""" if not date: date = datetime.now().strftime("%Y%m%d") url = f"http://datacenter-web.eastmoney.com/api/data/v1/get" params = { "sortColumns": "NET_BUY_AMT", "sortTypes": "-1", "pageSize": "50", "pageNumber": "1", "reportName": "RPT_DMSK_TS", "columns": "ALL", "filter": f"(TRADE_DATE='{date}')" } try: resp = self.session.get(url, params=params, timeout=10) data = resp.json() return data.get("result", {}).get("data", []) except: return []Technical Analysis
The
fetch_dragon_tigermethod retrieves financial ranking data through plaintext HTTP. HTTP provides neither server authentication nor transport integrity. A network-positioned attacker can therefore intercept the request and modify the response before it reaches the application.The method immediately parses the response as JSON and returns the embedded records without checking the final URL, validating a cryptographic signature, verifying the response schema, or applying reasonable value constraints. Consequently, a forged but syntactically valid JSON response would be treated as legitimate financial data.
This method was not found in the normal monitoring loop, which reduces immediate exposure. However, it remains an exposed part of the analysis engine and could be used directly or integrated into the monitoring workflow later.
Attack Path
- A user or application component invokes
fetch_dragon_tiger. - The Skill sends an unencrypted HTTP request to the external financial-data endpoint.
- A ...[truncated 927 chars]
- A user or application component invokes
- Remediation
View remediation
Remediation Suggestions
- Replace the HTTP endpoint with its verified HTTPS equivalent:
python url = "https://datacenter-web.eastmoney.com/api/data/v1/get" - Preserve TLS certificate verification and do not use
verify=False. - Reject redirects that downgrade the connection from HTTPS to HTTP.
- Call
resp.raise_for_status()before parsing the response. - Verify that the response content type is JSON.
- Validate the response against an explicit schema, including expected field names, types, date formats, and numerical ranges.
- Log transport and validation failures without silently treating malformed responses as valid empty datasets.
- If the provider does not support HTTPS, replace it with a trusted provider that offers authenticated transport.
- Replace the HTTP endpoint with its verified HTTPS equivalent: