T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/fetch_explosive_articles.py:241
- Finding
- API credentials transmitted over connections with TLS certificate verification disabled<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/fetch_explosive_articles.py:241-275` - `scripts/xiaohongshu-similar-account.py:293-319` **Vulnerability Type**: Improper TLS certificate and hostname validation **Risk Level**: High ### Vulnerable Code `scripts/fetch_explosive_articles.py:241-275`: ```python http_request = ( f"GET {full_path} HTTP/1.1\r\n" f"Host: {host}\r\n" f"X-API-KEY: {api_key or ''}\r\n" f"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\r\n" f"Accept: application/json, text/plain, */*\r\n" f"Accept-Language: zh-CN,zh;q=0.9,en;q=0.8\r\n" f"Connection: close\r\n" f"\r\n" ) # DNS resolution ip_address = socket.gethostbyname(host) # Create socket connection sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(45) sock.connect((ip_address, 443)) # SSL wrapping context = ssl.create_default_context() context.check_hostname = False context.verify_mode = ssl.CERT_NONE ssl_sock = context.wrap_socket(sock, server_hostname=None) ssl_sock.sendall(http_request.encode('utf-8')) ``` `scripts/xiaohongshu-similar-account.py:293-319`: ```python api_key = get_api_key() payload = { "redId": redId if redId else "", "track": track if track else "", "maxFans": maxFans if maxFans else "", "minFans": minFans if minFans is not None else "", "level": level if level else "", "source": "小红书对标账号-ClawHub" } headers = { "Content-Type": "application/json", "X-API-KEY": api_key } data = json.dumps(payload).encode("utf-8") req = urllib.request.Request(url, data=data, headers=headers, method="POST") ssl_ctx = ssl.create_default_context() ssl_ctx.check_hostname = False ssl_ctx.verify_mode = ssl.CERT_NONE try: with urllib.request.urlopen(req, context=ssl_ctx, timeout=30) as resp: result = json.loads(resp.read().decode("utf-8")) ``` ### Technical Analysis Both implementations deliberately disable certificate-chain verification an ...[truncated 2369 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove both TLS-verification overrides: - Do not set `check_hostname` to `False`. - Do not set `verify_mode` to `ssl.CERT_NONE`. 2. Preserve Server Name Indication and hostname validation: ```python context = ssl.create_default_context() with socket.create_connection(("redfox.hk", 443), timeout=45) as sock: with context.wrap_socket(sock, server_hostname="redfox.hk") as tls_sock: tls_sock.sendall(http_request.encode("utf-8")) ``` 3. For `urllib`, use its verified default context: ```python with urllib.request.urlopen(req, timeout=30) as resp: result = json.loads(resp.read().decode("utf-8")) ``` Alternatively: ```python ssl_ctx = ssl.create_default_context() with urllib.request.urlopen(req, context=ssl_ctx, timeout=30) as resp: result = json.loads(resp.read().decode("utf-8")) ``` 4. Prefer a mature HTTP client rather than manually parsing HTTP over raw sockets. 5. Fail closed on certificate errors. Do not retry with verification disabled. 6. Rotate any API keys previously used over hostile or untrusted networks. 7. Add automated tests confirming that self-signed certificates and hostname mismatches are rejected. ]]>