T09 · Insecure Skill Coding Practices
Error
- Location
utils/gaode_client.py:16- Finding
Gaode API Key May Be Exposed Through Unsanitized Exception Messages
- Content
View full analysis
Dict: """统一 GET 请求""" params["key"] = self.api_key resp = self.session.get(f"{self.BASE_URL}/{endpoint}", params=params, timeout=10) resp.raise_for_status() data = resp.json() if data.get("status") != "1": raise RuntimeError(f"API 调用失败: {data.get('info', '未知错误')}") return data ``` ```python # tools/search_transit.py:52-58 except Exception as e: return json.dumps( {"success": False, "message": f"地理编码失败：{e}"}, ensure_ascii=False ) ``` ```python # tools/search_transit.py:62-68 try: route_data = client.plan_transit(origin_coord, dest_coord, city) except Exception as e: return json.dumps( {"success": False, "message": f"公交路线规划失败：{e}"}, ensure_ascii=False ) ``` ### Technical Analysis The client appends `GAODE_API_KEY` to every request as a query-string parameter. The call to `raise_for_status()` can create a `requests` exception whose textual representation contains the complete request URL, including its query string. The transit tool catches broad exceptions and directly interpolates their raw text into user-visible JSON. Consequently, an upstream HTTP error, proxy-generated error, or similar request failure may cause the API key to appear in the returned response. Callers that do not catch this exception may also expose the keyed URL through runtime error logs. This is a credential-handling flaw because sensitive authentication material crosses from an internal request into an untrusted output or logging channel without redaction. ### Attack Path 1. An attacker invokes `search_transit` with a destination tha ...[truncated 1015 chars]- Remediation
View remediation