T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/fund-trading.py:32
- Finding
- OAuth Credentials and Bearer Tokens Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fund-trading.py:32`, `scripts/fund-trading.py:112-128`, `scripts/fund-trading.py:170-182`, and `scripts/fund-trading.py:220-226` **Vulnerability Type**: Plaintext transmission of authentication credentials **Risk Level**: High ### Vulnerable Code ```python API_ENDPOINT = "http://127.0.0.1:8080/openApi" ``` ```python url = f"{API_ENDPOINT}/openapi/v1/oauth/token" body = json.dumps( { "grantType": "client_credentials", "clientId": client_id, "clientSecret": client_secret, } ).encode("utf-8") req = urllib.request.Request( url, data=body, headers={"Content-Type": "application/json"}, method="POST" ) try: with urllib.request.urlopen(req, timeout=30) as response: result = json.loads(response.read().decode("utf-8")) ``` ```python url = f"{API_ENDPOINT}{path}" headers = { "Content-Type": "application/json", "Authorization": f"Bearer {token}", } data = json.dumps(body or {}).encode("utf-8") if method == "POST" else None req = urllib.request.Request(url, data=data, headers=headers, method=method) try: with urllib.request.urlopen(req, timeout=30) as response: return json.loads(response.read().decode("utf-8")) ``` ```python url = f"{API_ENDPOINT}/openapi/v1/channel/register" body = json.dumps({"username": username}).encode("utf-8") req = urllib.request.Request( url, data=body, headers={"Content-Type": "application/json"}, method="POST" ) ``` ### Technical Analysis The API endpoint is hardcoded with the plaintext `http://` scheme. The OAuth token request sends the account's client ID and client secret to this endpoint, while subsequent requests send a reusable bearer token in the `Authorization` header. Trading requests may also contain fund codes, order identifiers, monetary amounts, or redemption shares. Loopback traffic does not cross the external network under normal conditions, but HTTP provides no server authentication or t ...[truncated 1804 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace the hardcoded HTTP endpoint with the documented environment-based configuration: ```python API_ENDPOINT = os.environ.get( "OPENAPI_URL", "https://openapi.nicaifu.com/openApi", ).rstrip("/") ``` 2. Reject plaintext endpoints by default: ```python from urllib.parse import urlparse parsed = urlparse(API_ENDPOINT) if parsed.scheme != "https": raise ValueError("OPENAPI_URL must use HTTPS") ``` 3. If plaintext loopback HTTP is required for development, require an explicit opt-in setting, emit a prominent warning, and never enable it by default. 4. Authenticate any local service rather than relying solely on the loopback address. 5. Ensure TLS certificates are validated using the default trusted certificate store; do not add certificate-verification bypasses. 6. Document the exact destination, transmitted fields, and credential handling behavior. 7. Add tests verifying that non-HTTPS production endpoints are rejected and that `OPENAPI_URL` is actually honored. ]]>