T09 · Insecure Skill Coding Practices
- Location
calendar.py:21- Finding
API Key Transmitted in URL Query Parameters
- Content
View full analysis
Vulnerability Details
File Location:
calendar.py:21-30andcalendar.py:62-65
Vulnerability Type: Sensitive credential exposure through URL query parameters
Risk Level: MediumVulnerable Code
python def query_calendar(appkey: str, req: dict): params = {"appkey": appkey} date = req.get("date") if not date: return {"error": "missing_param", "message": "date is required"} params["date"] = date islunar = req.get("islunar") if islunar is not None: params["islunar"] = islunar islunarmonth = req.get("islunarmonth") if islunarmonth is not None: params["islunarmonth"] = islunarmonth try: resp = requests.get(CALENDAR_QUERY_URL, params=params, timeout=10)python def query_holiday(appkey: str): params = {"appkey": appkey} try: resp = requests.get(CALENDAR_HOLIDAY_URL, params=params, timeout=10)Technical Analysis
Both API operations place
JISU_API_KEYin theparamsdictionary passed torequests.get. Therequestslibrary serializes these parameters into the request URL, producing a URL similar to:text https://api.jisuapi.com/calendar/query?appkey=SECRET&date=2015-10-22HTTPS protects the URL while it is in transit between the client and the destination server, but it does not prevent the complete URL from being recorded at either endpoint or by trusted infrastructure. Query strings may be retained in application diagnostics, HTTP client debugging output, reverse-proxy logs, API gateway logs, monitoring systems, exception reports, or upstream access logs.
The project does not itself enable request logging, so exploitation depends on another component recording or exposing request URLs. Nevertheless, placing a reusable credential in a URL unnecessarily increases its exposure surface compared with sending it in an authorization header or request body.
A
...[truncated 1109 chars]
- Remediation
View remediation
Remediation Suggestions
-
Prefer an API authentication header if the provider supports one:
python headers = {"Authorization": f"Bearer {appkey}"} resp = requests.get( CALENDAR_QUERY_URL, headers=headers, params={"date": date}, timeout=10, ) -
If JisuAPI requires the
appkeyquery parameter and offers no safer authentication mechanism:- Request that the provider support header-based credentials.
- Disable or redact query-string logging in HTTP diagnostics, proxies, gateways, and monitoring tools.
- Apply explicit redaction for parameter names such as
appkey,api_key,token, andauthorization. - Never include prepared request URLs or
resp.request.urlin errors or logs. - Restrict the key to only the required calendar APIs, source IP addresses, and minimum necessary quota where the provider supports such controls.
- Rotate the existing key if full request URLs may already have been logged.
- Use separate credentials for development, testing, and production to limit exposure scope.
-
Preserve loading the key from the environment rather than embedding it in source code, and document that process listings, debug logs, and command-line arguments must not contain the key.
-