T09 · Insecure Skill Coding Practices
- Location
scripts/fund_query.py:65- Finding
Unauthenticated HTTP Transport Permits Financial Data Tampering
- Content
View full analysis
Vulnerability Details
File Location:
scripts/fund_query.py, lines 65, 99, and 135-141
Vulnerability Type: Plaintext HTTP transport for external financial-data APIs
Risk Level: MediumVulnerable Code
python def get_estimate(fund_code: str) -> dict: """查询实时估值""" url = f"http://fundgz.1234567.com.cn/js/{fund_code}.js"python def get_info(fund_code: str) -> dict: """查询基金基本信息""" url = f"http://fund.eastmoney.com/pingzhongdata/{fund_code}.js"python def get_history(fund_code: str, page_size: int = 10) -> dict: """查询历史净值""" url = f"http://api.fund.eastmoney.com/f10/lsjz?fundCode={fund_code}&pageIndex=1&pageSize={page_size}" try: req = urllib.request.Request(url, headers={ 'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36', 'Referer': 'http://fund.eastmoney.com/' }) with urllib.request.urlopen(req, timeout=10) as resp: data = json.loads(resp.read().decode('utf-8'))The shared request helper also sends a plaintext HTTP Referer:
python req = urllib.request.Request(url, headers={ 'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36', 'Referer': 'http://fund.eastmoney.com/' }) with urllib.request.urlopen(req, timeout=10) as resp: return resp.read().decode('utf-8', errors='ignore')Technical Analysis
Every external endpoint is addressed through unencrypted HTTP. HTTP provides neither confidentiality nor server authentication nor integrity protection. Consequently, an attacker with a suitable network position—such as a compromised gateway, hostile Wi-Fi access point, malicious proxy, or upstream network adversary—can observe requests and alter responses in transit.
The application trusts the returned JSON, JSONP, and JavaScript-derived fields and uses them to generate user-visible fund names, estimated values, percentages, dates, and historical NAV records ...[truncated 1720 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace every API URL with an HTTPS endpoint supported by the provider:
https://fundgz.1234567.com.cn/...https://fund.eastmoney.com/...https://api.fund.eastmoney.com/...
- Change the Referer to HTTPS where required by the service.
- Preserve Python's default TLS certificate and hostname verification; do not install an unverified SSL context.
- Prevent HTTPS-to-HTTP redirect downgrades by using a redirect handler that rejects any redirect whose destination scheme is not HTTPS.
- Fail closed when authenticated HTTPS transport is unavailable rather than retrying through HTTP.
- Validate response schemas and expected field types before formatting results.
- Constrain or escape remote textual fields before embedding them in Markdown output.
- Where the provider offers authenticity controls, verify signed responses or compare critical financial values against an independent trusted source.
- Replace every API URL with an HTTPS endpoint supported by the provider: