T09 · Insecure Skill Coding Practices
Error
- Location
- jq_config.py:8
- Finding
- Hardcoded and Enabled Third-Party Service Credentials<![CDATA[ ## Vulnerability Details **File Locations**: - `jq_config.py:8-10` - `tushare_config.py:8-11` - `hs300_research_system/jq_config.py:8-10` - `hs300_research_system/tushare_config.py:8-11` - `data_fetcher.py:45-56, 72-82` - `hs300_research_system/data_fetcher.py:45-56, 72-82` **Vulnerability Type**: Hardcoded secrets and enabled external authentication **Risk Level**: High ### Vulnerable Code The following values are redacted in this report but are committed as plaintext, reusable credentials in the source files: ```python # jq_config.py:8-10 JQ_USER = '[REDACTED PHONE NUMBER]' JQ_PASSWORD = '[REDACTED PLAINTEXT PASSWORD]' JQ_AUTH = True ``` ```python # tushare_config.py:8-11 TUSHARE_TOKEN = '[REDACTED TUSHARE TOKEN]' # Whether to enable Tushare Pro TUSHARE_AUTH = True ``` The data-fetching module consumes and transmits these credentials through the corresponding third-party SDKs: ```python # data_fetcher.py:45-56 try: from jq_config import JQ_USER, JQ_PASSWORD, JQ_AUTH import jqdatasdk as _jq JQ_AVAILABLE = JQ_AUTH and True except Exception: JQ_AVAILABLE = False try: from tushare_config import TUSHARE_TOKEN, TUSHARE_AUTH import tushare as _ts if TUSHARE_AUTH and TUSHARE_TOKEN: _ts.set_token(TUSHARE_TOKEN) TUSHARE_AVAILABLE = True else: TUSHARE_AVAILABLE = False except Exception: TUSHARE_AVAILABLE = False ``` ```python # data_fetcher.py:72-82 def _jq_login(): if not JQ_AVAILABLE: return False try: _jq.auth(JQ_USER, JQ_PASSWORD) logger.info("✅ JQData login successful") return True except Exception as e: logger.warning(f"❌ JQData login failed: {e}") return False ``` ### Technical Analysis Reusable JQData account credentials and a Tushare API token are stored directly in version-controlled Python modules. Any person or process with access to the distributed project can extract and use them independently of the application. The r ...[truncated 1937 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the exposed JQData password and Tushare token. 2. Review account access logs and quota usage for unauthorized activity. 3. Remove all credentials from the current source tree, packaged artifacts, release archives, and repository history. 4. Read credentials from environment variables or an operating-system secret manager: ```python import os JQ_USER = os.getenv("JQDATA_USER") JQ_PASSWORD = os.getenv("JQDATA_PASSWORD") JQ_AUTH = bool(JQ_USER and JQ_PASSWORD) TUSHARE_TOKEN = os.getenv("TUSHARE_TOKEN") TUSHARE_AUTH = bool(TUSHARE_TOKEN) ``` 5. Default all optional authenticated data sources to disabled unless the user explicitly configures them. 6. Provide a non-sensitive `.env.example` or configuration template containing placeholders only. 7. Add `.env`, local secret files, and generated credential files to `.gitignore`. 8. Add automated secret scanning to commits, CI, and release packaging. 9. Make implementation and documentation consistent regarding whether JQData is enabled. 10. Avoid logging credential values or SDK exceptions that may contain authentication data. ]]>