T09 · Insecure Skill Coding Practices
Warning
- Location
references/jsapi-auth.md:20- Finding
Plaintext HTTP Proxy Configuration Exposes Map API Traffic
- Content
View full analysis
window._DiMapSecurityConfig = { serviceHost: "你的代理服务器域名" // 例如：serviceHost: 'http://1.1.1.1:80/api/v2/web/' } ``` ```nginx server { listen 80; # nginx端口设置，可按实际端口修改 server_name 127.0.0.1; # nginx server_name 对应进行配置，可按实际添加或修改 # Web服务API 代理 location /api/v2/web/ { set $args "$args&jscode=客户端key"; proxy_pass https://lbs.xiaojukeji.com/api/v2/web/; } # Web静态文件 代理 location /api/v2/static/ { set $args "$args&jscode=客户端key"; proxy_pass https://lbs.xiaojukeji.com/api/v2/static/; } } ``` ### Technical Analysis The security guidance demonstrates a browser-facing proxy URL using plain HTTP and configures Nginx to listen only on TCP port 80. Although the connection from Nginx to the DiDi provider uses HTTPS, TLS protection does not cover the network path between the user's browser and the proxy. Applications adopting this example may transmit map API requests, search terms, route information, coordinates, or geolocation-related data without transport encryption. An attacker positioned on the same untrusted network, or otherwise able to intercept the browser-to-proxy connection, can observe requests and alter requests or responses. The issue does not independently grant operating-system privileges or access to the proxy host. Exploitation requires network visibility or control over the plaintext connection. ### Attack Path 1. A developer deploys the documented configuration with an `http://` `serviceHost` and an Nginx listener on port 80. 2. A user accesses map functionality through a network observable by an attacker, such as an untrusted wireless network. 3. The browser sends map API traffic to the configured proxy over plaintext HTTP. 4. The attack ...[truncated 824 chars]- Remediation
View remediation