T09 · Insecure Skill Coding Practices
Error
- Location
- index.js:43
- Finding
- Plaintext Transmission of User Queries and Authentication Material## Vulnerability Details **File Location**: `index.js:43-76` **Vulnerability Type**: Sensitive data transmitted over unencrypted HTTP **Risk Level**: High ### Vulnerable Code ```js // Generate access token function generateAccessToken(appKey, sign, router) { const tokenContent = `${appKey}:${sign}:${router}`; return Buffer.from(tokenContent).toString('base64'); } // Call the article keyword search API async function searchArticles(params) { const config = readConfig(); if (!config || !config.app_key || !config.app_secret) { throw new Error('Please configure app_key and app_secret in config.json first'); } const router = '/pubsent/full-search/index'; const baseUrl = 'http://databus.gsdata.cn:8888/api/service'; // Generate signature const sign = generateSign(params, config.app_secret); // Generate access token const accessToken = generateAccessToken(config.app_key, sign, router); // Construct query string const queryString = new URLSearchParams(params).toString(); const url = `${baseUrl}?${queryString}`; // Send request try { const response = await fetch(url, { method: 'GET', headers: { 'access-token': accessToken } }); ``` ### Technical Analysis The Skill sends requests to a hardcoded `http://` endpoint without transport encryption. Each request includes: - User-supplied search keywords and filters in the URL query string. - The application key, request signature, and API route encoded into the `access-token` header. - Date ranges, media filters, and sentiment filters derived from user input. Base64 encoding does not provide confidentiality. A party capable of observing network traffic can decode the token and recover its components. Because HTTP provides neither encryption nor endpoint authentication, an on-path attacker can also modify requests or API responses. Network access is necessary for the d ...[truncated 2317 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the endpoint with the service provider's officially supported HTTPS endpoint: ```js const baseUrl = 'https://databus.gsdata.cn:8888/api/service'; ``` This change must only be made after confirming that the provider supports TLS on the selected hostname and port. 2. Fail closed if HTTPS is unavailable. Do not silently fall back to HTTP. 3. Restrict redirects so an HTTPS request cannot be redirected to an HTTP destination: ```js const response = await fetch(url, { method: 'GET', redirect: 'manual', headers: { 'access-token': accessToken } }); ``` 4. If supported by the API, transmit search parameters in an HTTPS POST body rather than a GET URL to reduce leakage through URL logs. 5. Use short-lived server-issued credentials or include a timestamp and cryptographically random nonce in signed requests if the API supports them. 6. Prefer a modern message authentication algorithm such as HMAC-SHA-256 instead of MD5 when permitted by the provider's authentication protocol. 7. Add explicit request timeouts and response-size limits to reduce availability risks from a slow or malicious endpoint. 8. Document exactly which user-derived fields are transmitted to the third-party service and obtain user consent where queries may contain confidential information. 9. Add automated tests that reject non-HTTPS endpoints and redirects to plaintext HTTP.