T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ip_geo.py:45- Finding
Lookup Targets and Geolocation Results Transmitted over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ip_geo.py, lines 45-78
Vulnerability Type: Plaintext transmission of potentially sensitive lookup data
Risk Level: MediumComplete Code Snippet
python def lookup_ip(ip_address): """Look up geolocation for a single IP address using ip-api.com.""" url = f"http://ip-api.com/json/{ip_address}?fields=status,message,country,countryCode,region,regionName,city,zip,lat,lon,timezone,isp,org,as,query" try: req = urllib.request.Request(url, headers={"User-Agent": "IPGeoToolkit/1.0"}) with urllib.request.urlopen(req, timeout=10) as resp: data = json.loads(resp.read().decode()) if data.get("status") == "fail": return {"error": data.get("message", "lookup failed"), "query": ip_address} return data except (urllib.error.URLError, OSError, json.JSONDecodeError) as e: return {"error": str(e), "query": ip_address} def lookup_batch(ips): """Batch lookup using ip-api.com batch endpoint (max 100 per request).""" results = [] # ip-api.com batch: POST up to 100 IPs for i in range(0, len(ips), 100): batch = ips[i:i+100] url = "http://ip-api.com/batch?fields=status,message,country,countryCode,region,regionName,city,zip,lat,lon,timezone,isp,org,as,query" payload = json.dumps(batch).encode("utf-8") try: req = urllib.request.Request( url, data=payload, headers={ "User-Agent": "IPGeoToolkit/1.0", "Content-Type": "application/json", }, method="POST", ) with urllib.request.urlopen(req, timeout=30) as resp: data = json.loads(resp.read().decode()) results.extend(data)Technical Analysis
Both single and batch geol ...[truncated 2290 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the plaintext endpoints with HTTPS endpoints from a geolocation provider that supports TLS for every required operation:
python url = f"https://secure-provider.example/json/{encoded_target}?fields=..." - Retain Python's default TLS certificate and hostname verification; do not introduce an unverified SSL context to bypass certificate errors.
- If the selected provider does not offer HTTPS on the applicable service tier, migrate to an HTTPS-capable provider rather than silently falling back to HTTP.
- If temporary HTTP compatibility is unavoidable, require explicit user opt-in and display a prominent warning that lookup targets and results can be intercepted or modified.
- Validate returned JSON structure and expected field types. This does not replace TLS, but it limits malformed or unexpected response handling.
- Apply strict target validation with
ipaddress.ip_address()for IP-only inputs. If domain lookup remains supported, validate hostnames and safely encode them before inserting them into URL paths. - Add automated tests that reject non-HTTPS production API URLs and verify that redirects cannot downgrade requests from HTTPS to HTTP.
- Replace the plaintext endpoints with HTTPS endpoints from a geolocation provider that supports TLS for every required operation: