T09 · Insecure Skill Coding Practices
Warning
- Location
src/clients/qichacha.ts:83- Finding
Unrestricted API Base URL Enables Credential Disclosure and Server-Side Request Forgery
- Content
View full analysis
{ const timestamp = Math.floor(Date.now() / 1000).toString(); const token = defaultSign(this.apiKey, this.secretKey, timestamp); return { Token: token, Timespan: timestamp }; } private async call( path: string, query: Record, ): Promise> { const url = new URL(this.baseUrl + path); url.searchParams.set('key', this.apiKey); for (const [k, v] of Object.entries(query)) { if (v !== undefined && v !== '') url.searchParams.set(k, String(v)); } try { const response = await fetch(url.toString(), { method: 'GET', headers: this.signHeaders(), signal: AbortSignal.timeout(this.timeoutMs), }); ``` The unrestricted destination is exposed through the plugin configuration: ```json "qichacha_base_url": { "type": "string", "description": "v0.2 起。可选。企查查 API Base URL，默认 https://api.qichacha.net；私有部署或不同套餐可覆盖。" } ``` ### Technical Analysis The `qichacha_base_url` configuration value is used directly to construct an outbound request. The implementation does not: - Require HTTPS. - Restrict the hostname to an approved Qichacha endpoint. - Reject loopback, link-local, private-ne ...[truncated 3022 chars]- Remediation
View remediation