T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/patent_search.py:104
- Finding
- Unencrypted Transmission of Potentially Confidential Patent Search Data## Vulnerability Details **File Location**: `scripts/patent_search.py`, lines 104–115 **Vulnerability Type**: Plaintext transmission of sensitive data **Risk Level**: Medium ### Vulnerable Code ```python encoded_query = urllib.parse.quote(query) # Innojoy simple search endpoint url = f"http://www.innojoy.com/search/index.html?kw={encoded_query}" headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36", "Accept": "text/html,application/xhtml+xml", } try: req = urllib.request.Request(url, headers=headers) with urllib.request.urlopen(req, timeout=30) as response: html = response.read().decode("utf-8") ``` The insecure HTTP URL is also included in generated output at lines 124 and 133: ```python "url": f"http://www.innojoy.com/search/index.html?kw={encoded_query}", ``` ### Technical Analysis The Innojoy search provider is accessed over plaintext HTTP. User-provided search terms are URL-encoded and placed in the query string, but URL encoding provides no confidentiality or integrity protection. Patent searches may include keywords derived from unpublished inventions or complete technical disclosures. Any network intermediary able to observe the connection can read these terms. An active intermediary can also modify the HTTP response, redirect the connection, or alter links returned to the user. The Skill recommends multi-platform searches, including Innojoy, in `SKILL.md`. Therefore, invoking the documented `-s all` or explicit `-s innojoy` workflow reaches the affected path. ### Attack Path 1. A user supplies keywords or disclosure content concerning an unpublished invention. 2. The Skill runs `patent_search.py` with the Innojoy provider, directly or through the `all` provider selection. 3. `search_innojoy()` embeds the user input in an HTTP query parameter. 4. The application sends the request over the network without TLS. 5. A network-positioned attacker, proxy, ISP, or untrusted access-p ...[truncated 793 chars]
- Remediation
- ## Remediation Suggestions 1. Replace every Innojoy `http://` endpoint at lines 106, 124, and 133 with a verified `https://` endpoint. 2. Confirm that TLS certificate validation remains enabled; do not introduce an unverified SSL context or suppress certificate errors. 3. If Innojoy does not provide a functional HTTPS endpoint, disable this provider rather than transmitting patent information over plaintext HTTP. 4. Obtain explicit user consent before submitting invention-related content to third-party services, particularly when the `all` provider option is selected. 5. Minimize transmitted data by sending narrowly scoped keywords instead of complete disclosure text. 6. Avoid placing sensitive input in URLs where it may be retained in browser history, proxy logs, or server access logs. Use a documented HTTPS POST API where the provider supports one. 7. Add automated tests or static checks that reject plaintext HTTP endpoints in network-enabled provider implementations. 8. Document which third parties receive search data and warn users not to submit confidential details unless disclosure is authorized.