T09 · Insecure Skill Coding Practices
Warning
- Location
package_tracker/kdniao.py:18- Finding
Plaintext HTTP Transport Exposes Sandbox Tracking Data
- Content
View full analysis
Vulnerability Details
File Location:
package_tracker/kdniao.py:18,package_tracker/kdniao.py:62-76, andpackage_tracker/kdniao.py:83-106; related default configuration atpackage_tracker.json:7-10
Vulnerability Type: Sensitive data transmitted over unencrypted HTTP
Risk Level: MediumVulnerable Code
python KDNIAO_API_URL = "https://api.kdniao.com/Ebusiness/EbusinessOrderHandle.aspx" KDNIAO_SANDBOX_URL = "http://sandboxapi.kdniao.com:8080/kdniaosandbox/gateway/exterfaceInvoke.json"python def __init__( self, ebusiness_id: str | None = None, api_key: str | None = None, sandbox: bool = False, request_type: str | None = None, api_url: str | None = None, sandbox_url: str | None = None, ): self.ebusiness_id = ebusiness_id or "" self.api_key = api_key or "" self.request_type = request_type or KDNIAO_REQUEST_TYPE_TRACK resolved_api_url = api_url or KDNIAO_API_URL resolved_sandbox_url = sandbox_url or KDNIAO_SANDBOX_URL self.base_url = resolved_sandbox_url if sandbox else resolved_api_url if not self.ebusiness_id or not self.api_key: raise ValueError( "Kdniao requires EBusinessID and ApiKey. " "Provide them via JSON config (providers.kdniao) or pass to constructor." )python def track( self, shipper_code: str, logistic_code: str, order_code: str = "", customer_name: str = "", **kwargs: Any, ) -> dict[str, Any]: body = _request_body( self.ebusiness_id, self.api_key, shipper_code, logistic_code, request_type=self.request_type, order_code=order_code, customer_name=customer_name, ) req = urllib.request.Request( self.base_url, data=body, method="POST", headers={"Content-Type": "application/x-www-form-urlencod ...[truncated 2854 chars]- Remediation
View remediation
Remediation Suggestions
- Replace the sandbox URL with an official HTTPS endpoint if Kdniao provides one.
- Validate
api_urlandsandbox_urlduring initialization and reject every scheme other thanhttps. - Consider restricting endpoint hosts to an explicit allowlist of trusted Kdniao domains to prevent credentials and shipment data from being redirected to attacker-controlled servers.
- If no HTTPS sandbox exists, disable sandbox networking by default and require explicit acknowledgement before permitting plaintext transport.
- Never permit production credentials, real tracking numbers, order references, or customer information to be used with a plaintext sandbox.
- Document that URL encoding and Base64 signing do not protect request confidentiality.
- Add automated tests confirming that HTTP and unsupported URL schemes are rejected.
Example hardening:
python from urllib.parse import urlparse def _validate_endpoint(url: str) -> str: parsed = urlparse(url) if parsed.scheme.lower() != "https": raise ValueError("Kdniao endpoints must use HTTPS") if parsed.hostname not in { "api.kdniao.com", "sandboxapi.kdniao.com", }: raise ValueError("Untrusted Kdniao endpoint host") return url resolved_api_url = _validate_endpoint(api_url or KDNIAO_API_URL) resolved_sandbox_url = _validate_endpoint(sandbox_url or KDNIAO_SANDBOX_URL)