T09 · Insecure Skill Coding Practices
Warning
- Location
search.py:458- Finding
API Credential Exposed Through URL Query Parameters
- Content
View full analysis
Dict[str, object]: start = req.get("start") end = req.get("end") if not start: return {"error": "missing_param", "message": "start is required"} if not end: return {"error": "missing_param", "message": "end is required"} params = {"appkey": appkey, "start": start, "end": end} if req.get("ishigh") is not None and req.get("ishigh") != "": params["ishigh"] = req.get("ishigh") if req.get("date"): params["date"] = req.get("date") r = requests.get(TRAIN_STATION2S_URL, params=params, timeout=12) ``` ```python def _train_line(appkey: str, req: Dict[str, object]) -> Dict[str, object]: trainno = req.get("trainno") if not trainno: return {"error": "missing_param", "message": "trainno is required"} params = {"appkey": appkey, "trainno": trainno} if req.get("date"): params["date"] = req.get("date") r = requests.get(TRAIN_LINE_URL, params=params, timeout=12) ``` ```python def _train_ticket(appkey: str, req: Dict[str, object]) -> Dict[str, object]: start = req.get("start") end = req.get("end") date = req.get("date") if not start: return {"error": "missing_param", "message": "start is required"} if not end: return {"error": "missing_param", "message": "end is required"} if not date: return {"error": "missing_param", "message": "date is required"} params = {"appkey": appkey, "start": start, "end": end, "date": date} r = requests.get(TRAIN_TICKET_URL, params=params, timeout=12) ``` ### Technical Analysis All three train-query functions place `JISU_API_KEY` into the `appkey` query parameter of an HTTP GET request. Although the endpoints use HTTPS and therefore ...[truncated 1830 chars]- Remediation
View remediation