T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/data_sources.py:123
- Finding
- Market data retrieved over unauthenticated plaintext HTTP<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/data_sources.py:123-132` - `scripts/data_sources.py:183-192` - `scripts/data_sources.py:250-274` **Vulnerability Type**: Cleartext transport with no server authentication or response-integrity protection **Risk Level**: Medium ### Vulnerable Code ```python # TencentSource.fetch norm_symbol = normalize_symbol(symbol, 'tencent') url = f"http://qt.gtimg.cn/q={norm_symbol}" req = urllib.request.Request(url) req.add_header('User-Agent', 'Mozilla/5.0') req.add_header('Referer', 'https://stockapp.finance.qq.com/') with urllib.request.urlopen(req, timeout=10) as response: content = response.read().decode('gbk', errors='ignore') ``` ```python # SinaSource.fetch norm_symbol = normalize_symbol(symbol, 'sina') url = f"http://hq.sinajs.cn/s={norm_symbol}" req = urllib.request.Request(url) req.add_header('User-Agent', 'Mozilla/5.0') req.add_header('Referer', 'https://finance.sina.com.cn/') with urllib.request.urlopen(req, timeout=10) as response: content = response.read().decode('gbk', errors='ignore') ``` ```python # EastMoneySource.fetch fields = [ 'f43', 'f44', 'f45', 'f46', 'f47', 'f48', 'f50', 'f51', 'f52', 'f58', 'f60', ] url = f"http://push2.eastmoney.com/api/qt/stock/get?secid={code}&fields={','.join(fields)}" req = urllib.request.Request(url) req.add_header('User-Agent', 'Mozilla/5.0') req.add_header('Referer', 'https://quote.eastmoney.com/') with urllib.request.urlopen(req, timeout=10) as response: result = json.loads(response.read().decode('utf-8')) ``` ### Technical Analysis All three active providers are contacted over plaintext HTTP. HTTP provides neither server authentication nor transport integrity. The HTTPS values in the `Referer` headers do not secure the actual requests. An attacker able to observe or alter the user's network traffic—such as a malicious Wi-Fi operator, compromised router, proxy, ISP-level intermediary, or ...[truncated 1854 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace every `http://` provider URL with a provider-supported `https://` endpoint. 2. Retain Python's default TLS certificate and hostname verification; do not introduce an unverified SSL context. 3. Explicitly reject redirects from HTTPS to HTTP. 4. If a provider does not support authenticated HTTPS, remove it from the default source list rather than silently downgrading transport security. 5. Validate response structure, timestamps, numeric ranges, and symbol identity before using returned data. 6. For alerting and portfolio calculations, consider corroborating unusually large price movements against a second HTTPS source. 7. Log provider failures without silently treating manipulated or stale information as trustworthy. 8. Update `SKILL.md` and `references/api_docs.md` so examples do not encourage plaintext HTTP use. ]]>