T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/a-stock-report.js:13- Finding
Market Data Retrieved Over Unencrypted HTTP
- Content
View full analysis
{ const client = url.startsWith('https') ? https : http; const req = client.get(url, options, (res) => { let data = ''; res.on('data', (chunk) => data += chunk); res.on('end', () => { try { resolve(JSON.parse(data)); } catch (e) { reject(e); } }); }); req.on('error', reject); req.setTimeout(10000, () => { req.destroy(); reject(new Error('Request timeout')); }); }); } ``` API-controlled board data is then inserted into Markdown without escaping: ```javascript hotBoards.slice(0, 5).forEach((board, i) => { report += `| ${i + 1} | ${board.name} | ${board.change} | ${board.leader} |\n`; }); ``` ### Technical Analysis Both Eastmoney API endpoints use plaintext HTTP. Consequently, the server cannot be authenticated through TLS and response integrity is not cryptographically protected. An attacker with a network position—such as a malicious Wi-Fi operator, compromised router, proxy, or upstream network actor—can intercept and alter the responses. The application parses the response as trusted JSON without checking the HTTP status, response content type, schema, numeric ranges, or source authenticity. Modified index values directly influence the calculated market sentiment, while modified sector values influence sector ordering and automatically generated focus, risk, and ca ...[truncated 1839 chars]- Remediation
View remediation