T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/baidu_route_link.py:75
- Finding
- Precise Location Data Exposed Through a Plaintext HTTP Route URL<![CDATA[ ## Vulnerability Details **File Location**: `scripts/baidu_route_link.py`, lines 75–101 **Vulnerability Type**: Sensitive information transmitted over an insecure channel **Risk Level**: High ### Vulnerable Code ```python def build_baidu_link( self, origin_lat: float, origin_lng: float, dest_lat: float, dest_lng: float, origin_name: Optional[str] = None, dest_name: Optional[str] = None, mode: str = "driving", region: Optional[str] = None, coord_type: str = "gcj02", ) -> str: if origin_name: origin = f"name:{origin_name}|latlng:{origin_lat},{origin_lng}" else: origin = f"{origin_lat},{origin_lng}" if dest_name: destination = f"name:{dest_name}|latlng:{dest_lat},{dest_lng}" else: destination = f"{dest_lat},{dest_lng}" params: Dict[str, str] = { "origin": origin, "destination": destination, "mode": mode, "coord_type": coord_type, "output": "html", "src": self.src, } if region: params["region"] = region return "http://api.map.baidu.com/direction?" + urlencode(params) ``` ### Technical Analysis The generated route URL uses plaintext HTTP while embedding exact origin and destination coordinates. Optional human-readable origin and destination names are also included in the query string. Although the preceding route-calculation API call uses HTTPS, the link returned to the user does not. When the link is opened, its query string may be visible to network intermediaries such as public Wi-Fi operators, proxies, gateways, or other on-path observers. An active intermediary could also modify the response or redirect the user to a malicious destination. URLs may additionally be retained in browser history, proxy logs, analytics systems, and referrer data. In the context of a medical triage Skill, the destination may reveal an intended hospital or medical specialty, making the exposed route data more ...[truncated 1201 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the plaintext URL with an HTTPS endpoint: ```python return "https://api.map.baidu.com/direction?" + urlencode(params) ``` 2. Verify that the selected Baidu endpoint officially supports HTTPS and fails closed rather than falling back to HTTP. 3. Avoid including human-readable origin names unless they are necessary. 4. Consider reducing location precision where exact coordinates are not required. 5. Inform the user that route planning sends coordinates to Baidu and obtain consent before transmission. 6. Do not log generated route URLs because they contain sensitive query parameters. 7. Where supported, use short-lived opaque route identifiers rather than placing precise coordinates directly in a reusable URL. 8. Add an automated test that rejects generated links whose scheme is not HTTPS. ]]>