T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/fund_query.py:65
- Finding
- Unauthenticated HTTP Transport Permits Financial Data Tampering## Vulnerability Details **File Location**: `scripts/fund_query.py`, lines 65, 99, and 135-141 **Vulnerability Type**: Plaintext HTTP transport for external financial-data APIs **Risk Level**: Medium ### Vulnerable Code ```python def get_estimate(fund_code: str) -> dict: """查询实时估值""" url = f"http://fundgz.1234567.com.cn/js/{fund_code}.js" ``` ```python def get_info(fund_code: str) -> dict: """查询基金基本信息""" url = f"http://fund.eastmoney.com/pingzhongdata/{fund_code}.js" ``` ```python def get_history(fund_code: str, page_size: int = 10) -> dict: """查询历史净值""" url = f"http://api.fund.eastmoney.com/f10/lsjz?fundCode={fund_code}&pageIndex=1&pageSize={page_size}" try: req = urllib.request.Request(url, headers={ 'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36', 'Referer': 'http://fund.eastmoney.com/' }) with urllib.request.urlopen(req, timeout=10) as resp: data = json.loads(resp.read().decode('utf-8')) ``` The shared request helper also sends a plaintext HTTP Referer: ```python req = urllib.request.Request(url, headers={ 'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36', 'Referer': 'http://fund.eastmoney.com/' }) with urllib.request.urlopen(req, timeout=10) as resp: return resp.read().decode('utf-8', errors='ignore') ``` ### Technical Analysis Every external endpoint is addressed through unencrypted HTTP. HTTP provides neither confidentiality nor server authentication nor integrity protection. Consequently, an attacker with a suitable network position—such as a compromised gateway, hostile Wi-Fi access point, malicious proxy, or upstream network adversary—can observe requests and alter responses in transit. The application trusts the returned JSON, JSONP, and JavaScript-derived fields and uses them to generate user-visible fund names, estimated values, percentages, dates, and historical NAV records ...[truncated 1720 chars]
- Remediation
- ## Remediation Suggestions 1. Replace every API URL with an HTTPS endpoint supported by the provider: - `https://fundgz.1234567.com.cn/...` - `https://fund.eastmoney.com/...` - `https://api.fund.eastmoney.com/...` 2. Change the Referer to HTTPS where required by the service. 3. Preserve Python's default TLS certificate and hostname verification; do not install an unverified SSL context. 4. Prevent HTTPS-to-HTTP redirect downgrades by using a redirect handler that rejects any redirect whose destination scheme is not HTTPS. 5. Fail closed when authenticated HTTPS transport is unavailable rather than retrying through HTTP. 6. Validate response schemas and expected field types before formatting results. 7. Constrain or escape remote textual fields before embedding them in Markdown output. 8. Where the provider offers authenticity controls, verify signed responses or compare critical financial values against an independent trusted source.