T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/main.py:59
- Finding
- Sensitive biomedical terms and API credentials are transmitted in URL query strings<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:59-60`, `scripts/main.py:93-101`, and `scripts/main.py:146-149` **Vulnerability Type**: Sensitive information exposure through URL query parameters **Risk Level**: Medium ### Complete Code Snippet ```python query_string = urllib.parse.urlencode(params) url = f"{self.BASE_URL}{endpoint}?{query_string}" ``` ```python def search(self, term: str, sabs: Optional[List[str]] = None, page_size: int = 10) -> List[Dict]: """Search UMLS for concepts.""" if not self.api_key: return [] params = { "string": term, "apiKey": self.api_key, "pageSize": str(page_size) } if sabs: params["sabs"] = ",".join(sabs) response = self._make_request("/search/current", params) ``` ```python def search(self, term: str) -> List[Dict]: """Search MeSH descriptors.""" encoded_term = urllib.parse.quote(term) url = f"{self.BASE_URL}/lookup/descriptor?label={encoded_term}" response = self._make_request(url) ``` ### Technical Analysis The UMLS client places both the user-provided biomedical term and the UMLS API key in an HTTPS URL query string. The MeSH client likewise places the biomedical term in a URL query string. HTTPS protects the request while it is in transit, but query strings can still be recorded by local proxies, enterprise gateways, reverse proxies, monitoring products, browser or HTTP diagnostics, server access logs, and exception telemetry. An API key in a query string therefore has a broader exposure surface than a credential carried in an authorization header. Biomedical terms may also contain protected health information when derived from clinical records. Remote access is explicitly enabled through `--use-api`, and the destinations are fixed official NLM domains. Consequently, this behavior is necessary for the optional external lookup feature and is not covert exfiltration. However, transmitting raw clinica ...[truncated 1539 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use an API-supported authorization header instead of placing the UMLS key in the query string. If the upstream service mandates a query parameter, clearly document this residual risk and avoid recording request URLs. 2. Use a POST request body for sensitive search terms where the API supports it. 3. Add an explicit warning or confirmation before remote lookup, stating that every input term will be sent to NLM. 4. Reject or de-identify likely PHI before external transmission. For clinical datasets, default to local-only processing. 5. Ensure exception messages, debug output, proxy configuration, and telemetry never record full request URLs. 6. Accept the API key through an environment variable or protected credential store rather than a command-line argument, because command-line values may be visible in process listings and shell history. 7. Document the exact external hosts contacted and provide a network allowlist limited to: - `uts-ws.nlm.nih.gov` - `id.nlm.nih.gov` 8. Add tests verifying that credentials and sensitive terms are absent from application logs. 9. Rotate any API key that may already have been captured in logs. ]]>