T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/call_java_api.py:34
- Finding
- Plaintext HTTP Is Permitted for Business Data## Vulnerability Details **File Location**: `scripts/call_java_api.py:34-65`; insecure HTTP examples also appear in `SKILL.md:10`, `SKILL.md:25`, and `SKILL.md:70` **Vulnerability Type**: Transmission of potentially sensitive business data over plaintext HTTP **Risk Level**: Medium **Complete Code Snippet**: ```python base_url = (os.environ.get("JAVA_API_URL") or "").rstrip("/") if not base_url: print('{"code": -1, "msg": "未配置 JAVA_API_URL 环境变量", "data": null}', file=sys.stderr) sys.exit(1) if args.health: url = f"{base_url}/api/skill/health" try: r = requests.get(url, timeout=10) r.raise_for_status() out = r.json() print(json.dumps(out, ensure_ascii=False)) except requests.RequestException as e: print(json.dumps({"code": -1, "msg": str(e), "data": None}, ensure_ascii=False), file=sys.stderr) sys.exit(1) return url = f"{base_url}/api/skill/{args.endpoint}" body = {} if args.action is not None: body["action"] = args.action if args.userId is not None: body["userId"] = args.userId if args.extra: try: body["extra"] = json.loads(args.extra) except json.JSONDecodeError: print('{"code": -1, "msg": "extra 不是合法 JSON", "data": null}', file=sys.stderr) sys.exit(1) try: r = requests.post(url, json=body, headers={"Content-Type": "application/json"}, timeout=30) r.raise_for_status() out = r.json() print(json.dumps(out, ensure_ascii=False)) except requests.RequestException as e: print(json.dumps({"code": -1, "msg": str(e), "data": None}, ensure_ascii=False), file=sys.stderr) sys.exit(1) ``` The documentation explicitly presents a plaintext endpoint: ```bash export JAVA_API_URL=http://your-server:8080 ``` ### Technical Analysis The script accepts `JAVA_API_URL` without validating its URL scheme. Consequently, both `http://` and `https://` endp ...[truncated 1686 chars]
- Remediation
- ## Remediation Suggestions 1. Parse `JAVA_API_URL` with `urllib.parse.urlparse` and require the `https` scheme. 2. Reject plaintext HTTP by default. If local development requires HTTP, permit it only for loopback addresses through an explicit opt-in flag such as `JAVA_API_ALLOW_INSECURE_LOCALHOST=1`. 3. Replace all documented HTTP examples with HTTPS examples. 4. Keep TLS certificate verification enabled and do not introduce `verify=False`. 5. For high-value operations, consider application-level request authentication, integrity protection, replay prevention, and short-lived credentials in addition to TLS. 6. Minimize sensitive information placed in the unrestricted `extra` object and document appropriate data-handling restrictions.