T09 · Insecure Skill Coding Practices
- Location
trademark.py:15- Finding
API Credential Exposed in URL Query String
- Content
View full analysis
Vulnerability Details
File Location:
trademark.py, lines 15–21
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: Mediumpython def _call_trademark_api(path: str, appkey: str, params: dict): all_params = {"appkey": appkey} all_params.update(params) url = f"{BASE_URL}/{path}" try: resp = requests.get(url, params=all_params, timeout=10)Technical Analysis
The function inserts
appkeyintoall_paramsand passes that dictionary torequests.get()through theparamsargument. The Requests library serializes these parameters into the URL query string, producing a request resembling:text https://api.jisuapi.com/trademark/search?appkey=SECRET_VALUE&keyword=...HTTPS protects the request from passive interception while it is in transit, but it does not prevent the complete URL from being retained by systems that legitimately process or observe the request. Query strings may be captured in HTTP server access logs, reverse-proxy logs, API gateway telemetry, application-performance monitoring systems, debugging output, or prepared-request diagnostics.
Consequently, anyone with access to an insufficiently protected log or trace containing the request URL could recover the API key. No evidence indicates that the application itself logs the URL; the risk arises from placing a reusable credential in a URL that surrounding infrastructure may record.
Attack Path
- An authorized user invokes the trademark search or detail command.
- The skill reads
JISU_API_KEYfrom the environment. - The skill serializes that credential into the HTTPS request URL as the
appkeyquery parameter. - The complete URL is retained by an API endpoint, proxy, gateway, monitoring platform, or diagnostic system.
- An attacker or unauthorized operator with access to those records extracts the AppKey.
- The attacker submits independent requests to the JisuAPI service using the exposed cr ...[truncated 551 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer an API-supported authorization header so the credential is not part of the request URL:
python headers = {"Authorization": f"Bearer {appkey}"} resp = requests.get(url, headers=headers, params=params, timeout=10)-
If the provider supports credential submission only in a POST body, use that documented mechanism rather than a query parameter.
-
If JisuAPI strictly requires
appkeyin the query string:- Configure clients, proxies, gateways, servers, and monitoring platforms to redact
appkeyand preferably all query strings. - Do not log prepared request URLs or exception objects that may include URLs.
- Use a dedicated, least-privileged key for this skill.
- Apply provider-side IP restrictions, usage limits, and billing alerts where available.
- Rotate the current key after confirming that historical logs do not retain it.
- Establish regular key rotation and immediate revocation procedures.
- Restrict access to infrastructure logs and apply appropriate retention limits.
- Configure clients, proxies, gateways, servers, and monitoring platforms to redact
-
Add automated tests or static checks that reject logging of authorization values and sensitive query parameters.