T09 · Insecure Skill Coding Practices
Warning
- Location
- check.js:137
- Finding
- Potentially Sensitive Dashboard URLs Are Persisted and Propagated Without Sanitization<![CDATA[ ## Vulnerability Details **File Location**: `check.js:137-166` and `check.js:183-193` **Supporting Documentation**: `USER-GUIDE.md:26-28`, `USER-GUIDE.md:136-151`, and `usage-log.template.md:16-18` **Vulnerability Type**: Plaintext storage and disclosure of potentially sensitive URL parameters **Risk Level**: Medium ### Vulnerable Code The complete dashboard URL is written into the generated usage log: ```javascript let log = readUsageLog(); if (!log) { // Create a new log log = `# Usage Log ## Current Status (Last Updated: ${timestamp}) ### Service Info - **Service:** ${data.serviceName} - **Status:** 正常 - **Remaining Days:** ${data.remainingDays} - **Alert Threshold:** ${data.threshold}% ### Usage Tracking | Date | Current | Notes | |------|---------|-------| | ${today} | ${data.current}% | Auto-check | ### Panel URL ${data.panelUrl} --- ## Monitoring Setup - **Check Frequency:** Every ${data.checkIntervalHours} hours - **Last Check:** ${timestamp} `; fs.writeFileSync(USAGE_LOG_PATH, log); return; } ``` The same complete URL is embedded in an alert intended to be sent through a messaging tool: ```javascript function createAlertMessage(data) { return `⚠️ 服务使用量提醒 📊 服务：${data.serviceName} 📈 当前用量：${data.current}% 📈 可用额度：${100 - data.current}% ⏰ 剩余天数：${data.remainingDays} 天 🔗 查看：${data.panelUrl} 当前用量已达告警阈值（${data.threshold}%），请及时关注用量或考虑增加额度。`; } ``` The user guide explicitly acknowledges that dashboard URLs may contain user-specific parameters: ```markdown **Note:** Each user's URL may be different and may contain user-specific parameters, so it must be supplied by the user. ``` The generated-log template also requires the URL to be stored: ```markdown ## Panel URL <Populated from config.json> ``` ### Technical Analysis Dashboard URLs copied from a browser address bar can contain sensitive information, including: - Signed query parameters - Temporary access tokens - Tenant, workspace, account, or organization ide ...[truncated 3187 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Parse and validate the URL securely** Use the standard `URL` parser instead of prefix matching: ```javascript function validateAndSanitizePanelUrl(value) { const url = new URL(value); if (url.protocol !== 'https:') { throw new Error('panelUrl must use HTTPS'); } if (url.username || url.password) { throw new Error('panelUrl must not contain embedded credentials'); } return url; } ``` 2. **Do not persist query strings or fragments** Construct a sanitized display URL before logging: ```javascript function getSafeDisplayUrl(value) { const url = validateAndSanitizePanelUrl(value); url.search = ''; url.hash = ''; return url.toString(); } ``` Use this sanitized value in `usage-log.md` and alert messages. 3. **Separate navigation and display URLs** Keep the complete URL only in the protected configuration when it is genuinely necessary for navigation. Introduce an optional `displayUrl` for logs and alerts, and require it to be free of tokens and sensitive parameters. 4. **Avoid including dashboard URLs in alerts by default** Prefer a generic message such as “Open the configured service dashboard” unless the user explicitly enables link inclusion. 5. **Create the documented `.gitignore`** Add at least: ```gitignore config.json usage-log.md ``` Documentation should not claim that these files are ignored unless the protection is included and verified. 6. **Restrict generated-file permissions** On supported platforms, create sensitive files with owner-only permissions: ```javascript fs.writeFileSync(USAGE_LOG_PATH, log, { mode: 0o600 }); ``` 7. **Warn users about signed URLs** Explicitly instruct users not to configure URLs containing access tokens, signatures, session identifiers, or temporary authentication parameters. 8. **Redact existing logs and notification history** Us ...[truncated 247 chars]