T09 · Insecure Skill Coding Practices
- Location
bazi.py:61- Finding
API Credential Exposed in URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
bazi.py, lines 61–76
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
python data = { "appkey": appkey, "name": name, "city": city, "year": year, "month": month, "day": day, "hour": hour, "minute": minute, "sex": sex, "islunar": req.get("islunar", 0), "istaiyang": req.get("istaiyang", 0), "islunarmonth": req.get("islunarmonth", 2), } try: resp = requests.get(PAIPAN_URL, params=data, timeout=15)Technical Analysis
The application includes
appkeyin the dictionary passed torequests.get()through theparamsargument. The Requests library serializes these parameters into the URL query string, producing a request resembling:text https://api.jisuapi.com/bazi/paipan?appkey=SECRET&name=...TLS protects the URL while it is transmitted over HTTPS, but it does not prevent the complete URL from being recorded at endpoints or intermediary infrastructure. Query strings may be retained in API gateway logs, reverse-proxy access logs, observability platforms, debugging output, monitoring systems, or server-side request records.
Consequently, personnel or attackers who gain access to those records may recover the API credential. This risk is greater than using a dedicated authorization header because URL query strings are routinely logged by default.
The same request also includes personal data such as name, city, date and time of birth, and sex. Transmission of this information to JisuAPI is disclosed in
SKILL.md, so it is not an undisclosed exfiltration finding. Nevertheless, operators should ensure that request URLs containing this information are not retained unnecessarily.Attack Path
- A legitimate user invokes the Skill, causing it to make an HTTPS GET request to JisuAPI.
- The API key is serialized into the request URL as the
appkeyquery parameter. - A ...[truncated 1252 chars]
- Remediation
View remediation
Remediation Suggestions
- If supported by JisuAPI, transmit the credential in a dedicated authorization header rather than the URL:
python headers = {"Authorization": f"Bearer {appkey}"} params = { "name": name, "city": city, "year": year, "month": month, "day": day, "hour": hour, "minute": minute, "sex": sex, "islunar": req.get("islunar", 0), "istaiyang": req.get("istaiyang", 0), "islunarmonth": req.get("islunarmonth", 2), } resp = requests.get(PAIPAN_URL, headers=headers, params=params, timeout=15)-
If the provider supports POST requests, place sensitive parameters in the request body while retaining HTTPS. Confirm the exact authentication mechanism against the provider's official documentation.
-
If JisuAPI requires
appkeyin the query string:- Configure clients, proxies, gateways, monitoring tools, and server logs to redact the
appkeyparameter. - Avoid emitting complete request URLs in application or debugging logs.
- Restrict access to logs and apply short retention periods.
- Ensure telemetry and exception-reporting services scrub both the API key and personal birth information.
- Configure clients, proxies, gateways, monitoring tools, and server logs to redact the
-
Restrict the API key to only the required endpoint, source IP addresses, and minimum necessary quota where provider controls permit.
-
Rotate the current key if it may already have appeared in logs, and establish periodic credential rotation and revocation procedures.
-
Continue loading the key from the environment rather than embedding it in source code, and ensure environment values are not included in diagnostics or process dumps.