T09 · Insecure Skill Coding Practices
Warning
- Location
- core/i18n.py:184
- Finding
- Automatic Disclosure of Public IP Address to Third-Party Geolocation Services<![CDATA[ ## Vulnerability Details **File Location**: `core/i18n.py:184-207`, `core/i18n.py:268-278`, and `core/i18n.py:592` **Vulnerability Type**: Automatic third-party data disclosure and insecure plaintext HTTP communication **Risk Level**: Medium ### Vulnerable Code ```python _IP_GEO_APIS = [ { "url": "http://ip-api.com/json/?fields=status,countryCode,country,regionName,city", "timeout": 5, "parse": lambda r: (r.get("countryCode") or "").upper() if r.get("status") == "success" else "", }, { "url": "https://ipinfo.io/json", "timeout": 5, "parse": lambda r: (r.get("country") or "").upper(), }, { "url": "https://api.myip.com", "timeout": 5, "parse": lambda r: (r.get("cc") or "").upper(), }, { "url": "https://freegeoip.app/json/", "timeout": 8, "parse": lambda r: (r.get("country_code") or r.get("countryCode") or "").upper(), }, ] ``` ```python for api_cfg in _IP_GEO_APIS: try: resp = requests.get( api_cfg["url"], timeout=api_cfg.get("timeout", 5), headers={ "User-Agent": "MC-Skill-V1/1.0 (i18n geo detection)", "Accept": "application/json", }, ) if resp.status_code != 200: continue data = resp.json() cc = api_cfg["parse"](data) ``` The behavior is enabled automatically at module import: ```python # Module-load initialization with automatic detection enabled init_language(auto_detect=True) ``` ### Technical Analysis The internationalization module performs public-IP geolocation automatically when it is imported and no explicit language preference is available. `main.py` imports `core.i18n` during normal startup, so this network behavior can occur without the user invoking a network-dependent feature. Every contacted provider inherently receives the user's public IP address, request ti ...[truncated 2047 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable IP-based geolocation by default: ```python init_language(auto_detect=False) ``` 2. Use explicit language selection, a saved user preference, or the operating-system locale as the default detection mechanism. 3. Require informed, affirmative user consent before contacting any geolocation provider. 4. Remove the plaintext `http://ip-api.com` endpoint. If geolocation remains available, use HTTPS exclusively. 5. Use a single documented provider rather than disclosing the user's IP to multiple fallback services. 6. Add a configuration option such as `ENABLE_IP_GEOLOCATION = False`, without executing network requests merely by importing a module. 7. Document the provider, transmitted metadata, purpose, caching period, and opt-out procedure in the privacy notice. 8. Avoid performing network activity at import time; invoke optional geolocation only from an explicit initialization or user-interface action. ]]>