T09 · Insecure Skill Coding Practices
Warning
- Location
- stockindex.py:16
- Finding
- Potential API Credential Disclosure Through Raw Exception Output## Vulnerability Details **File Location**: `stockindex.py`, lines 16–25; output sink at line 83 **Vulnerability Type**: Sensitive credential exposure through verbose error handling **Risk Level**: Medium ### Technical Analysis The application places `JISU_API_KEY` in the HTTP query parameters and returns the unfiltered string representation of any exception raised by `requests.get()`. ```python def _call_api(path: str, appkey: str, params: dict = None): if params is None: params = {} all_params = {"appkey": appkey} all_params.update({k: v for k, v in params.items() if v not in (None, "")}) url = f"{BASE_URL}/{path}" try: resp = requests.get(url, params=all_params, timeout=10) except Exception as e: return {"error": "request_failed", "message": str(e)} ``` The returned error object is subsequently serialized to standard output: ```python print(json.dumps(result, ensure_ascii=False, indent=2)) ``` Because the API key is included in the prepared request URL, request-related exceptions may contain request details, including the URL or query string. Returning `str(e)` without sanitization creates a credential-disclosure channel. Output may then be retained in terminal history, application logs, agent transcripts, monitoring systems, or error collectors. The credential is transmitted to the intended service over HTTPS, so this finding does not allege plaintext network transmission. The weakness is specifically the possibility of exposing the credential through diagnostic output. ### Attack Path 1. A valid `JISU_API_KEY` is configured in the process environment. 2. The script constructs an HTTP request whose query string contains `appkey=<credential>`. 3. An attacker or an environmental failure causes a request exception that includes prepared-request information, such as through malformed proxy behavior, redirect failures, transport-layer errors, or ...[truncated 1283 chars]
- Remediation
- ## Remediation Suggestions 1. Do not return raw exception strings to users or agent output. Replace them with a fixed message: ```python except requests.RequestException: return { "error": "request_failed", "message": "The stock-index service request failed." } ``` 2. Catch `requests.RequestException` rather than the broad `Exception` class. Unexpected programming errors should be handled separately and logged through a controlled internal mechanism. 3. If diagnostic logging is required, log only the exception class and a sanitized message. Remove query strings entirely or explicitly redact `appkey` before recording request information. 4. Prefer an authorization header instead of a query parameter if the upstream API supports it. If query authentication is mandatory, ensure URLs are never emitted to standard output, exception telemetry, access logs, or tracing systems. 5. Add automated tests that simulate request exceptions containing a URL with `appkey=secret-value` and verify that neither the returned object nor serialized output contains the secret. 6. Rotate the API key if existing logs or transcripts may already contain request exception output.