T09 · Insecure Skill Coding Practices
- Location
index.js:43- Finding
Plaintext Transmission of User Queries and Authentication Material
- Content
View full analysis
Vulnerability Details
File Location:
index.js:43-76
Vulnerability Type: Sensitive data transmitted over unencrypted HTTP
Risk Level: HighVulnerable Code
js // Generate access token function generateAccessToken(appKey, sign, router) { const tokenContent = `${appKey}:${sign}:${router}`; return Buffer.from(tokenContent).toString('base64'); } // Call the article keyword search API async function searchArticles(params) { const config = readConfig(); if (!config || !config.app_key || !config.app_secret) { throw new Error('Please configure app_key and app_secret in config.json first'); } const router = '/pubsent/full-search/index'; const baseUrl = 'http://databus.gsdata.cn:8888/api/service'; // Generate signature const sign = generateSign(params, config.app_secret); // Generate access token const accessToken = generateAccessToken(config.app_key, sign, router); // Construct query string const queryString = new URLSearchParams(params).toString(); const url = `${baseUrl}?${queryString}`; // Send request try { const response = await fetch(url, { method: 'GET', headers: { 'access-token': accessToken } });Technical Analysis
The Skill sends requests to a hardcoded
http://endpoint without transport encryption. Each request includes:- User-supplied search keywords and filters in the URL query string.
- The application key, request signature, and API route encoded into the
access-tokenheader. - Date ranges, media filters, and sentiment filters derived from user input.
Base64 encoding does not provide confidentiality. A party capable of observing network traffic can decode the token and recover its components. Because HTTP provides neither encryption nor endpoint authentication, an on-path attacker can also modify requests or API responses.
Network access is necessary for the d ...[truncated 2317 chars]
- Remediation
View remediation
Remediation Suggestions
-
Replace the endpoint with the service provider's officially supported HTTPS endpoint:
js const baseUrl = 'https://databus.gsdata.cn:8888/api/service';This change must only be made after confirming that the provider supports TLS on the selected hostname and port.
-
Fail closed if HTTPS is unavailable. Do not silently fall back to HTTP.
-
Restrict redirects so an HTTPS request cannot be redirected to an HTTP destination:
js const response = await fetch(url, { method: 'GET', redirect: 'manual', headers: { 'access-token': accessToken } }); -
If supported by the API, transmit search parameters in an HTTPS POST body rather than a GET URL to reduce leakage through URL logs.
-
Use short-lived server-issued credentials or include a timestamp and cryptographically random nonce in signed requests if the API supports them.
-
Prefer a modern message authentication algorithm such as HMAC-SHA-256 instead of MD5 when permitted by the provider's authentication protocol.
-
Add explicit request timeouts and response-size limits to reduce availability risks from a slow or malicious endpoint.
-
Document exactly which user-derived fields are transmitted to the third-party service and obtain user consent where queries may contain confidential information.
-
Add automated tests that reject non-HTTPS endpoints and redirects to plaintext HTTP.
-