T09 · Insecure Skill Coding Practices
Error
- Location
references/_all_apis.json:16972- Finding
Plaintext HTTP Endpoints Expose Credentials and Personal Data in Transit
- Content
View full analysis
Vulnerability Details
File Location:
references/_all_apis.json, lines 16972–17031
Vulnerability Type: Sensitive data transmitted over unencrypted HTTP
Risk Level: HighComplete Vulnerable Code Snippet
json { "name": "门店POS账号新增/修改", "title": "门店POS账号新增/修改", "method": "POST", "path": "http://open-test.tcsl.com.cn/api/sly/newProxy/openapi/api/v1/staff/createorupdate", "request_params": [ { "name": "thirdId", "type": "是", "required": "String", "description": "第三方ID" }, { "name": "id", "type": "否", "required": "Long", "description": "商龙云id" }, { "name": "jobNumber", "type": "是", "required": "String", "description": "工号" }, { "name": "picUrl", "type": "否", "required": "String", "description": "工号图片" }, { "name": "orgList", "type": "是", "required": "array", "description": "所属机构" }, { "name": "-orgId", "type": "是", "required": "Long", "description": "机构id" }, { "name": "nickName", "type": "是", "required": "String", "description": "姓名" }, { "name": "password", "type": "是", "required": "String", "description": "密码" }, { "name": "status", "type": "是", "required": "Integer", "description": "启停状态: 0-禁用; 1-启用" }, { "name": "mobile", "type": "是", "required": "String", "description": "手机号" }, { "name": "email", "type": "否", "required": "String", "description": "邮箱" } ] }Technical Analysis
The API reference specifies a security-sensitive
POSToperation using plaintext HTTP. Its request schema includes a password, employee identity, telephone number, email address, organization membership, and account status.HTTP provides neither transport confidentiality nor cryptographic integrit ...[truncated 2102 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace every
http://API path with a verifiedhttps://endpoint supported by the service. - Configure clients to reject plaintext HTTP rather than silently downgrading or following cross-scheme redirects.
- Add an automated validation step that parses every documented API path and fails generation or publication when the scheme is not HTTPS.
- Verify TLS certificates and hostnames using the platform's standard trust store; do not disable certificate validation.
- Remove plaintext password values from examples and use clearly synthetic placeholders such as
${PASSWORD}. - Avoid returning passwords or password-equivalent fields in response examples.
- Rotate any credential that may previously have traversed the HTTP endpoints, particularly if it was reused in another environment.
- Review all related plaintext endpoints, including account, role, staff, and deletion APIs, rather than correcting only the cited occurrence.
- Document a strict separation between test and production credentials and prohibit reuse across environments.
- Where possible, use short-lived tokens and request signing in addition to TLS, while recognizing that signing does not replace transport encryption.
- Replace every