T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/trader.py:59- Finding
Market Quotes Retrieved Over Unencrypted HTTP
- Content
View full analysis
dict: """获取实时行情，使用新浪HTTP接口（直连稳定）""" import requests code = _clean_code(symbol) sc = _sina_code(code) url = f"http://hq.sinajs.cn/list={sc}" try: r = requests.get(url, headers={"Referer": "https://finance.sina.com.cn"}, timeout=10) ``` The batch quote implementation has the same weakness: ```python def _get_realtime_quotes_batch(symbols: list) -> list: """批量获取行情""" import requests codes = [_clean_code(s) for s in symbols] scodes = ",".join(_sina_code(c) for c in codes) url = f"http://hq.sinajs.cn/list={scodes}" try: r = requests.get(url, headers={"Referer": "https://finance.sina.com.cn"}, timeout=10) ``` ### Technical Analysis The application retrieves market quotes through plain HTTP. HTTP does not authenticate the remote server or protect response integrity. An attacker capable of intercepting or modifying network traffic can alter stock names, current prices, opening prices, closing prices, and other quote fields before the application processes them. The `Referer` header uses an HTTPS URL, but this does not secure the HTTP request or provide server authentication. Retrieved prices flow directly into market-price buy and sell calculations and can subsequently be persisted in the local portfolio. ### Attack Path 1. A user invokes a quote, buy, sell, positions, or balance operation that retrieves a real-time quote. 2. The application sends an HTTP request to `hq.sinajs.cn`. 3. An attacker controlling the local network, gateway, DNS path, or another interception point modifies the HTTP response. 4. The attacker substitutes a manipulated but syntactically valid price or stock name. 5. The ap ...[truncated 879 chars]- Remediation
View remediation