T09 · Insecure Skill Coding Practices
Warning
- Location
- package_tracker/kdniao.py:18
- Finding
- Plaintext HTTP Transport Exposes Sandbox Tracking Data## Vulnerability Details **File Location**: `package_tracker/kdniao.py:18`, `package_tracker/kdniao.py:62-76`, and `package_tracker/kdniao.py:83-106`; related default configuration at `package_tracker.json:7-10` **Vulnerability Type**: Sensitive data transmitted over unencrypted HTTP **Risk Level**: Medium ### Vulnerable Code ```python KDNIAO_API_URL = "https://api.kdniao.com/Ebusiness/EbusinessOrderHandle.aspx" KDNIAO_SANDBOX_URL = "http://sandboxapi.kdniao.com:8080/kdniaosandbox/gateway/exterfaceInvoke.json" ``` ```python def __init__( self, ebusiness_id: str | None = None, api_key: str | None = None, sandbox: bool = False, request_type: str | None = None, api_url: str | None = None, sandbox_url: str | None = None, ): self.ebusiness_id = ebusiness_id or "" self.api_key = api_key or "" self.request_type = request_type or KDNIAO_REQUEST_TYPE_TRACK resolved_api_url = api_url or KDNIAO_API_URL resolved_sandbox_url = sandbox_url or KDNIAO_SANDBOX_URL self.base_url = resolved_sandbox_url if sandbox else resolved_api_url if not self.ebusiness_id or not self.api_key: raise ValueError( "Kdniao requires EBusinessID and ApiKey. " "Provide them via JSON config (providers.kdniao) or pass to constructor." ) ``` ```python def track( self, shipper_code: str, logistic_code: str, order_code: str = "", customer_name: str = "", **kwargs: Any, ) -> dict[str, Any]: body = _request_body( self.ebusiness_id, self.api_key, shipper_code, logistic_code, request_type=self.request_type, order_code=order_code, customer_name=customer_name, ) req = urllib.request.Request( self.base_url, data=body, method="POST", headers={"Content-Type": "application/x-www-form-urlencod ...[truncated 2854 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the sandbox URL with an official HTTPS endpoint if Kdniao provides one. 2. Validate `api_url` and `sandbox_url` during initialization and reject every scheme other than `https`. 3. Consider restricting endpoint hosts to an explicit allowlist of trusted Kdniao domains to prevent credentials and shipment data from being redirected to attacker-controlled servers. 4. If no HTTPS sandbox exists, disable sandbox networking by default and require explicit acknowledgement before permitting plaintext transport. 5. Never permit production credentials, real tracking numbers, order references, or customer information to be used with a plaintext sandbox. 6. Document that URL encoding and Base64 signing do not protect request confidentiality. 7. Add automated tests confirming that HTTP and unsupported URL schemes are rejected. Example hardening: ```python from urllib.parse import urlparse def _validate_endpoint(url: str) -> str: parsed = urlparse(url) if parsed.scheme.lower() != "https": raise ValueError("Kdniao endpoints must use HTTPS") if parsed.hostname not in { "api.kdniao.com", "sandboxapi.kdniao.com", }: raise ValueError("Untrusted Kdniao endpoint host") return url resolved_api_url = _validate_endpoint(api_url or KDNIAO_API_URL) resolved_sandbox_url = _validate_endpoint(sandbox_url or KDNIAO_SANDBOX_URL) ```