T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/query.js:67
- Finding
- API Credentials and User Data Can Be Sent to Arbitrary Plaintext HTTP Endpoints## Vulnerability Details **File Location**: `scripts/query.js:18-21, 67-89`; `scripts/poll.js:17-20, 92-110` **Vulnerability Type**: Unrestricted destination and insecure transport for sensitive data **Risk Level**: High ### Vulnerable Code `scripts/query.js`: ```js const config = { apiKey: process.env.DATAHUB_API_KEY || null, baseUrl: process.env.DATAHUB_BASE_URL || 'https://datahub.codes', timeout: parseInt(process.env.DATAHUB_TIMEOUT) || 60000 }; ``` ```js async function submitQuery(query, sessionId = null) { const url = new URL('/api/datahub/execute/v0', BASE_URL); const payload = JSON.stringify({ query: query, sessionId: sessionId || undefined, key: API_KEY // 添加API Key到请求体 }); const options = { hostname: url.hostname, port: url.port || (url.protocol === 'https:' ? 443 : 80), path: url.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload), 'X-API-Key': API_KEY // 同时通过Header传递 }, timeout: TIMEOUT }; return new Promise((resolve, reject) => { const client = url.protocol === 'https:' ? https : http; ``` `scripts/poll.js`: ```js const config = { apiKey: process.env.DATAHUB_API_KEY || null, baseUrl: process.env.DATAHUB_BASE_URL || 'https://datahub.codes', timeout: parseInt(process.env.DATAHUB_TIMEOUT) || 60000 }; ``` ```js async function fetchResult(processId) { const url = new URL(`/api/processes/${processId}.md`, BASE_URL); // 将API Key添加到查询参数 url.searchParams.append('key', API_KEY); const options = { hostname: url.hostname, port: url.port || (url.protocol === 'https:' ? 443 : 80), path: url.pathname + url.search, method: 'GET', headers: { 'Accept': 'application/json, text/markdown, text/plain, */*', 'X-API-Key': API_KEY // 同时通过Header传递 ...[truncated 2397 chars]
- Remediation
- ## Remediation Suggestions 1. Enforce HTTPS before constructing any request: ```js const url = new URL('/api/datahub/execute/v0', BASE_URL); if (url.protocol !== 'https:') { throw new Error('DATAHUB_BASE_URL must use HTTPS'); } ``` 2. Remove the fallback to Node.js's `http` client and use `https.request` exclusively. 3. If only the official service is supported, require `url.hostname === 'datahub.codes'`. 4. If custom deployments are necessary, implement an explicit trusted-host allowlist and require HTTPS for every entry. 5. Reject URLs containing embedded credentials and consider rejecting unexpected ports. 6. Protect configuration files with restrictive filesystem permissions and document which configuration source takes precedence. 7. Send the API key through only one authentication channel, preferably the request header. 8. Add automated tests proving that plaintext HTTP and unapproved hostnames are rejected.