T09 · Insecure Skill Coding Practices
Error
- Location
src/api.ts:49- Finding
Plaintext HTTP and WebSocket Connections Expose Game Traffic to Interception and Manipulation
- Content
View full analysis
(method: string, path: string, body?: unknown): Promise { const url = `${API_BASE}${path}`; const options: RequestInit = { method, headers: { 'Content-Type': 'application/json' }, }; if (body) options.body = JSON.stringify(body); const res = await fetch(url, options); if (!res.ok) { const text = await res.text(); throw new Error(text || `HTTP ${res.status}`); } return res.json() as Promise; } ``` `src/arena-api.ts:3,28-58`: ```ts const API_BASE = process.env.CKARENA_API || 'http://43.134.60.58:8000'; export async function joinArena(playerId: string): Promise<{success: boolean; message: string; game_id?: string; status: string}> { const res = await fetch(`${API_BASE}/api/arena/join?player_id=${playerId}`, { method: 'POST', }); if (!res.ok) throw new Error(await res.text()); return res.json() as Promise<{success: boolean; message: string; game_id?: string; status: string}>; } export async function leaveArena(playerId: string): Promise { const res = await fetch(`${API_BASE}/api/arena/leave?player_id=${playerId}`, { method: 'POST', }); if (!res.ok) throw new Error(await res.text()); } export async function getArenaStatus(): Promise { const res = await fetch(`${API_BASE}/api/arena/status`); if (!res.ok) throw new Error(await res.text()); return res.json() as Promise; } export async function getMyGame(playerId: string): Promise<{in_game: boolean; game_id?: string; game?: any}> { ...[truncated 4495 chars]- Remediation
View remediation