T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_stock.py:113- Finding
Unauthenticated HTTP Allows Market Data Manipulation
- Content
View full analysis
dict: """Fetch a single stock quote.""" prefix, clean_code = get_market_prefix(code) symbol = f"{prefix}{clean_code}" url = f"http://hq.sinajs.cn/list={symbol}" raw = fetch_url(url) if raw: data = parse_sina_stock(raw, symbol) if data: return data # Fallback: Eastmoney market = 1 if prefix == "sh" else 0 url2 = ( f"http://push2.eastmoney.com/api/qt/stock/get" f"?secid={market}.{clean_code}" f"&fields=f43,f44,f45,f46,f47,f48,f57,f58,f60,f107,f169,f170,f171" ) raw2 = fetch_url(url2, {"Referer": "https://www.eastmoney.com"}) ``` ```python def fetch_index() -> list: """Fetch major market indices.""" symbols = "s_sh000001,s_sz399001,s_sz399006,s_sh000688" names_map = { "s_sh000001": "上证指数", "s_sz399001": "深证成指", "s_sz399006": "创业板指", "s_sh000688": "科创50", } url = f"http://hq.sinajs.cn/list={symbols}" raw = fetch_url(url) ``` ```python def fetch_hot_sectors() -> list: """Fetch leading Eastmoney concept sectors.""" url = ( "http://push2.eastmoney.com/api/qt/clist/get" "?pn=1&pz=20&po=1&np=1&ut=bd1d9ddb04089700cf9c27f6f7426281" "&fltt=2&invt=2&fid=f3" "&fs=m:90+t:2+f:!50" "&fields=f2,f3,f4,f12,f14,f20,f128,f136,f207,f208,f209" ) raw = fetch_url(url, {"Referer": "https://www.eastmoney.com"}) ``` The reference documentation also explicitly directs cl ...[truncated 2882 chars]- Remediation
View remediation