T09 · Insecure Skill Coding Practices
Warning
- Location
- src/utils/request.js:123
- Finding
- API token transmitted in URL query parameters<![CDATA[ ## Vulnerability Details **File Location**: `src/utils/request.js:123-140` **Related Locations**: `src/api/search.js:95-120`, `src/api/comment.js:66-80`, `src/api/post.js:49-62`, `src/api/hot.js:16-23` **Vulnerability Type**: Credential exposure through query strings **Risk Level**: Medium ### Evidence The shared GET request function serializes every supplied parameter into the request URL: ```js async function getJson(path, params) { if (!path || typeof path !== "string") { throw new SkillError("PATH_INVALID", "path 必须是非空字符串"); } if (!params || typeof params !== "object") { throw new SkillError("PARAM_INVALID", "params 必须是对象"); } params._ = Date.now(); const fullPath = `${path}?${querystring.stringify(params)}`; const options = { host: constants.BASE_URL, path: fullPath, method: "GET", headers: { "Accept-Encoding": "identity" }, }; return await request(options); } ``` API callers include the secret token in that parameter object. For example: ```js const params = { _: Date.now(), token: token, keyword: keyword, sort_type: sort, publish_time: time, filter_duration: duration, content_type: content, limit: limit, }; const response = await requestApi( "GET", "/api/douyin/general-search/info", params, null, constants.QUERY_MAX_ATTEMPTS, "查询任务", ); ``` Equivalent query-string authentication is used for comment, creator-post, and hot-list requests. ### Technical Analysis The token from `GUAIKEI_API_TOKEN` becomes part of request targets such as: ```text /api/douyin/general-search/info?token=<secret>&keyword=<value>&... ``` HTTPS encrypts the request target while it is in transit, so a passive network observer cannot ordinarily read it. However, credentials in URLs are commonly retained by infrastructure that records request targets, including: - API server access logs; - reverse-proxy and load-balancer logs; - application performance monitoring and tracing systems; - debu ...[truncated 1833 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `token` from all URL parameter objects. 2. Transmit the credential in an HTTP authorization header, for example: ```js headers: { Authorization: `Bearer ${token}`, "Accept-Encoding": "identity", } ``` 3. Refactor `getJson()` and `postJson()` to accept authentication separately from ordinary request parameters. 4. Add a defensive check that rejects sensitive query keys such as `token`, `api_key`, `authorization`, and `secret`. 5. Configure the API server and intermediary infrastructure to redact query strings from historical and future access logs. 6. Rotate all existing tokens because previous requests may already have been retained in server or proxy logs. 7. Apply short token lifetimes, scoped API permissions, rate limits, and revocation support. 8. Add automated tests that assert generated request paths never contain the token value. 9. Avoid including user search terms and target URLs in GET query strings when they may be sensitive; use a POST body where practical. ]]>