T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/navigation.js:12
- Finding
- Unvalidated API Base URL Can Exfiltrate API Keys and Travel Data in Route Planning<![CDATA[ ## Vulnerability Details **File Location**: `scripts/navigation.js`, lines 12-13 and 35-57; the same unvalidated base URL is reused for route requests at lines 83-110 **Vulnerability Type**: Unvalidated external service endpoint / sensitive-data exfiltration **Risk Level**: Medium ### Vulnerable Code ```javascript const AMAP_API_KEY = process.env.AMAP_API_KEY || 'demo_key'; const AMAP_BASE_URL = process.env.AMAP_BASE_URL || 'https://restapi.amap.com'; /** * Geocoding: converts an address to coordinates */ async function geocode(address) { const url = new URL('/v3/geocode/geo', AMAP_BASE_URL); url.searchParams.set('key', AMAP_API_KEY); url.searchParams.set('address', address); return new Promise((resolve, reject) => { https.get(url.toString(), (res) => { let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => { try { const result = JSON.parse(data); if (result.status === '1' && result.geocodes && result.geocodes.length > 0) { resolve(result.geocodes[0].location); } else { reject(new Error(`Geocoding failed: ${address}`)); } } catch (err) { reject(err); } }); }).on('error', reject); }); } ``` Route requests use the same configuration: ```javascript const endpoint = mode === 'transit' ? '/v3/direction/transit/integrated' : `/v3/direction/${mode}`; const url = new URL(endpoint, AMAP_BASE_URL); url.searchParams.set('key', AMAP_API_KEY); url.searchParams.set('origin', originLoc); url.searchParams.set('destination', destLoc); https.get(url.toString(), (res) => { // Response processing }); ``` ### Technical Analysis `AMAP_BASE_URL` is read directly from the process environment and used as the base for outbound HTTPS requests without validating its hostname, port, credentials, or expected origin. The code then places the AMap API key and user travel information in URL query parameters. ...[truncated 1606 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the configurable base URL if endpoint customization is unnecessary. 2. If customization is required, parse and validate the configured URL before any request: - Require the `https:` protocol. - Allow only the exact hostname `restapi.amap.com`, or another explicit approved-host allowlist. - Reject embedded credentials, fragments, unexpected ports, and unapproved subdomains. 3. Construct requests from a fixed trusted origin and append only known API paths. 4. Avoid placing credentials in query strings where the upstream API supports secure authorization headers. 5. Ensure launchers and deployment systems prevent untrusted users from modifying the Skill's environment. 6. Apply request timeouts and response-size limits as defense-in-depth measures. 7. Rotate the AMap API key if execution with an untrusted `AMAP_BASE_URL` may already have occurred. ]]>