T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/a-stock-report.js:13
- Finding
- Market Data Retrieved Over Unencrypted HTTP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/a-stock-report.js`, lines 13-14 **Vulnerability Type**: Use of plaintext HTTP for integrity-sensitive financial data **Risk Level**: Medium ### Vulnerable Code ```javascript const CONFIG = { eastmoneyBoardApi: 'http://push2.eastmoney.com/api/qt/clist/get', eastmoneyStockApi: 'http://push2.eastmoney.com/api/qt/stock/get', }; ``` The configured endpoints are subsequently passed to a client selected according to the URL scheme: ```javascript function httpGet(url, options = {}) { return new Promise((resolve, reject) => { const client = url.startsWith('https') ? https : http; const req = client.get(url, options, (res) => { let data = ''; res.on('data', (chunk) => data += chunk); res.on('end', () => { try { resolve(JSON.parse(data)); } catch (e) { reject(e); } }); }); req.on('error', reject); req.setTimeout(10000, () => { req.destroy(); reject(new Error('Request timeout')); }); }); } ``` API-controlled board data is then inserted into Markdown without escaping: ```javascript hotBoards.slice(0, 5).forEach((board, i) => { report += `| ${i + 1} | ${board.name} | ${board.change} | ${board.leader} |\n`; }); ``` ### Technical Analysis Both Eastmoney API endpoints use plaintext HTTP. Consequently, the server cannot be authenticated through TLS and response integrity is not cryptographically protected. An attacker with a network position—such as a malicious Wi-Fi operator, compromised router, proxy, or upstream network actor—can intercept and alter the responses. The application parses the response as trusted JSON without checking the HTTP status, response content type, schema, numeric ranges, or source authenticity. Modified index values directly influence the calculated market sentiment, while modified sector values influence sector ordering and automatically generated focus, risk, and ca ...[truncated 1839 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace both API URLs with supported HTTPS endpoints: ```javascript const CONFIG = { eastmoneyBoardApi: 'https://push2.eastmoney.com/api/qt/clist/get', eastmoneyStockApi: 'https://push2.eastmoney.com/api/qt/stock/get', }; ``` 2. Reject plaintext URLs before issuing any request: ```javascript const parsedUrl = new URL(url); if (parsedUrl.protocol !== 'https:') { throw new Error('Only HTTPS endpoints are permitted'); } ``` 3. If redirects are implemented in the future, validate every redirect destination and reject HTTPS-to-HTTP downgrades. 4. Validate transport and response metadata: - Require an HTTP 2xx status. - Require an expected JSON content type. - Enforce a maximum response size. - Retain normal Node.js TLS certificate and hostname verification. 5. Validate the parsed response against a strict schema: - Require expected objects and fields. - Require finite numeric index and percentage values. - Apply reasonable length and range constraints. - Reject malformed or unexpected field types. 6. Escape untrusted text before embedding it in Markdown tables. At minimum, neutralize pipe characters, line breaks, and unsafe HTML or link syntax in board names. 7. Clearly label generated focus and risk statements as heuristic output rather than verified capital-flow or investment advice. ]]>