T09 · Insecure Skill Coding Practices
Warning
- Location
references/1-商户/示例代码/2-代扣扣款/申请扣款.md:40- Finding
Plaintext HTTP Callback Endpoints Are Permitted and Demonstrated
- Content
View full analysis
http://yoursite.com/wxpay.html ``` The service-provider deduction example contains the same insecure pattern: ```xml http://yoursite.com/wxpay.html ``` The callback guidance also explicitly permits callback URLs beginning with either HTTP or HTTPS rather than requiring HTTPS. ### Technical Analysis The Skill permits and repeatedly demonstrates unencrypted HTTP callback endpoints for financial agreement and deduction-result workflows. A developer following these stored examples may deploy a payment callback handler without transport-layer encryption. HTTP provides neither confidentiality nor transport integrity. An attacker positioned between WeChat Pay and the merchant endpoint could observe callback metadata, block callbacks, delay delivery, or replay captured requests. Proper V2 signature verification limits the attacker's ability to create or arbitrarily modify a valid signed callback, but it does not prevent disclosure, traffic analysis, denial of service, or replay of an authentic captured message. The risk is amplified because the Skill instructs the agent to retrieve and display stored examples rather than generate corrected implementations. Users may therefore copy the plaintext callback URL directly into an integration. ### Attack Path 1. A merchant requests a deduction or callback integration example from the Skill. 2. The Skill displays the stored example containing an `http:/ ...[truncated 1252 chars]- Remediation
View remediation