T09 · Insecure Skill Coding Practices
Error
- Location
gsdata_adapter.py:24- Finding
GSData Authentication and API Data Transmitted Over Plaintext HTTP
- Content
View full analysis
requests.Response: # GSData gateway commonly accepts params in query/body against one base URL. if method == "POST": return requests.post( self.base_url, data=params, headers=headers, timeout=30 ) return requests.get(self.base_url, params=params, headers=headers, timeout=30) ``` ### Technical Analysis The default API endpoint uses HTTP rather than HTTPS. Every real invocation derives an access token from the application key, request signature, and route, then places that token in the `access-token` request header. The token is Base64-encoded elsewhere in the file, but Base64 provides no confidentiality. Under the default configuration, the authentication token, request parameters, and returned GSData content cross the network without transport encryption or server authentication. For GET requests, user-provided parameters are also placed in the URL query string. These parameters may consequently be exposed not only to network observers but also to intermediary access logs and monitoring systems. This network access is necessary for the Skill's declared GSData functionality. Transmitting its credentials and data over plaintext HTTP is not necessary and violates least-exposure principles. ### Attack Path 1. A user or Agent invokes a GSData action without overriding `GSDATA_BASE_URL`. 2. The adapter generates a request signa ...[truncated 958 chars]- Remediation
View remediation