T09 · Insecure Skill Coding Practices
Error
- Location
src/index.ts:15- Finding
API token can be transmitted over plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
src/index.ts:15-17,src/index.ts:247-260, andsrc/index.ts:298-302
Vulnerability Type: Plaintext transmission of sensitive credentials
Risk Level: HighVulnerable Code
ts const BACKUP_URL1 = process.env.STOCKTODAY_BACKUP_URL1 || "http://111.229.164.2:8083/"; const BACKUP_URL2 = process.env.STOCKTODAY_BACKUP_URL2 || "http://124.223.112.152:6331/"; const BACKUP_URL3 = process.env.STOCKTODAY_BACKUP_URL3 || "http://110.42.211.9:9900/";ts async function fetchOne(url: string, endpoint: string, formData: URLSearchParams): Promise<{status: number; data: any; raw: string}> { try { const res = await fetch(`${url}${endpoint}`, { method: "POST", body: formData, headers: { "Content-Type": "application/x-www-form-urlencoded", "X-Client-Type": "StockToday-skill", "X-Client-Version": "1.3.11" }, signal: AbortSignal.timeout(30000) }); const raw = await res.text(); let data: any; try { data = JSON.parse(raw); } catch { data = raw; } return { status: res.status, data, raw }; } catch (e: any) { return { status: 0, data: null, raw: e?.message || String(e) }; } }ts const formData = new URLSearchParams(); formData.append("TOKEN", token); const urls = [BASE_URL, BACKUP_URL1, BACKUP_URL2, BACKUP_URL3];Technical Analysis
The API credential is included in a URL-encoded POST body for every backend request. The Skill defines three default fallback gateways using unencrypted HTTP and does not enforce an HTTPS-only policy for either the primary URL or fallback URLs.
Any request sent to an HTTP endpoint exposes the token and response data to network observers and active intermediaries. Encryption is especially important here because possession of the token is sufficient to authenticate API requests.
The current fallback loop ...[truncated 1532 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove all default plaintext HTTP fallback gateways.
- Require every configured backend URL to use the
https:protocol:ts function requireHttps(raw: string): string { const parsed = new URL(raw); if (parsed.protocol !== "https:") { throw new Error("StockToday backend URLs must use HTTPS"); } return parsed.toString(); } - Apply this validation to
STOCKTODAY_URLand every configured fallback URL before processing requests. - Replace bare IP addresses with authenticated HTTPS domain names whose certificates can be validated.
- Do not provide an option to disable TLS certificate validation.
- Correct the fallback loop separately so that only genuine transport failures or retryable responses cause failover, while preserving the HTTPS-only requirement.
- Rotate any token that may previously have been sent to an HTTP endpoint.
- Document the exact backend domains that receive tokens and allow administrators to enforce an outbound network allowlist.