T09 · Insecure Skill Coding Practices
- Location
cb_calendar.py:133- Finding
Plaintext HTTP Used for Financial Market Data Retrieval
- Content
View full analysis
Vulnerability Details
File Location:
cb_calendar.py:133-155
Related Locations:references/API.md:12-21,references/API.md:42-46,references/API.md:65-69,references/API.md:98-112
Vulnerability Type: Unauthenticated and unencrypted network transport
Risk Level: MediumVulnerable Code
python headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Referer': 'http://data.eastmoney.com/kzz/', } try: # Example URL; the correct API still needs to be identified url = "http://datacenter-web.eastmoney.com/api/data/v1/get" params = { 'reportName': 'RPT_BOND_CB_ISSUE', 'columns': 'ALL', 'filter': '', 'pageNum': 1, 'pageSize': 50, } response = requests.get(url, params=params, headers=headers, timeout=10) if response.status_code == 200: data = response.json() return parse_dongfangcai_data(data)The API documentation also recommends several plaintext endpoints:
text http://datacenter-web.eastmoney.com/api/data/v1/get http://vip.stock.finance.sina.com.cn/quotes_service/api/json_v2.php http://qt.gtimg.cn/q=sh600000 http://www.cninfo.com.cn/new/commonUrl/pageOfSearch?url=disclosure/list/search&keyWord={keyword}Technical Analysis
The application retrieves financial data over HTTP rather than HTTPS. Plaintext HTTP does not authenticate the remote server and does not protect response integrity. An attacker with a privileged network position—such as a malicious wireless access point, compromised router, proxy, ISP-level interceptor, or DNS attacker—can observe or modify requests and responses.
The implementation accepts any HTTP 200 response and immediately parses its JSON content. It does not validate transport security, verify the origin after redirects, authenticate the response, or enforce a strict response schema. Consequen ...[truncated 2104 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace every plaintext endpoint with an officially supported HTTPS endpoint.
- Reject redirects that downgrade an HTTPS request to HTTP.
- Configure an explicit redirect limit and verify the final response URL and hostname.
- Retain normal TLS certificate and hostname verification; never set
verify=False. - Apply strict response validation before processing:
- Require the expected content type.
- Enforce maximum response size.
- Validate the top-level JSON structure.
- Validate field types, formats, and reasonable numeric ranges.
- Reject missing or unexpected critical fields.
- Fail closed when secure retrieval is unavailable rather than silently falling back to plaintext transport.
- Cross-check high-impact information, such as redemption deadlines and issue dates, against an authoritative exchange or issuer source.
- Update
references/API.mdso all examples use HTTPS and clearly prohibit plaintext fallback. - Add tests confirming that HTTP URLs and HTTPS-to-HTTP redirects are rejected.