T09 · Insecure Skill Coding Practices
Error
- Location
scripts/check_gold_price.py:43- Finding
Unauthenticated Plain-HTTP Financial Price Feed
- Content
View full analysis
Vulnerability Details
File Location:
scripts/check_gold_price.py, lines 43–74
Vulnerability Type: Unauthenticated transport of integrity-sensitive financial data
Risk Level: HighVulnerable Code
python def fetch_ccb_gold_price() -> dict: """从新浪财经获取上海金交所 Au99.99 报价（作为建行积存金平替）""" ssl_ctx = _create_ssl_context() import time url = f"http://hq.sinajs.cn/rn={int(time.time()*1000)}&list=gds_AU9999" req = Request(url, headers={ "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Referer": "https://finance.sina.com.cn/", }) with urlopen(req, timeout=15, context=ssl_ctx) as resp: data = resp.read().decode("gbk") if '="' not in data: raise ValueError("新浪财经数据格式异常: " + data) content = data.split('="')[1].split('";')[0] parts = content.split(',') if len(parts) < 13: raise ValueError(f"价格数据异常: 字段数量不足 ({len(parts)})") current_price = float(parts[0]) # 新浪接口中： # parts[2] 是买一价(Bid)，代表买家的最高出价，是客户能够卖出（套现）的价格 (Customer Sell Price) # parts[3] 是卖一价(Ask)，代表卖家的最低要价，是客户能够买入（建仓）的价格 (Customer Buy Price) buy_price = float(parts[3]) if float(parts[3]) > 0 else current_price sell_price = float(parts[2]) if float(parts[2]) > 0 else current_price update_time = f"{parts[12]} {parts[6]}" # 例如: 2026-03-25 23:22:39 return { "buy_price": buy_price, "sell_price": sell_price, "mid_price": current_price, "update_time": update_time, }Technical Analysis
The quote endpoint uses plain HTTP. Consequently, the response has neither transport confidentiality nor cryptographic integrity, and the SSL context passed to
urlopendoes not protect this HTTP request.Any attacker able to intercept or redirect the connection can replace the quote with a forged response. The implemented validation only checks ...[truncated 1824 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the HTTP endpoint with a documented HTTPS endpoint and retain normal certificate and hostname verification.
- Explicitly reject redirects or final response URLs that downgrade the request from HTTPS to HTTP.
- Remove the misleading SSL context usage for plain HTTP; an SSL context only provides protection when TLS is actually used.
- Validate the complete response schema, expected instrument identifier, field types, positive prices, timestamp format, and timestamp freshness.
- Apply reasonable bounds to prices, bid/ask spreads, and single-update movements. Treat exceptional values as errors rather than immediately persisting them.
- Confirm alert-triggering movements through an independent trusted data source before issuing financial recommendations or changing the persistent baseline.
- Write a new baseline only after the quote passes all integrity and plausibility checks.
- Use atomic, permission-restricted writes for local state files to reduce the risk of corruption or local tampering.