search

CQU-AI / cqu-kb

第三方重庆大学课表日历生成工具
GNU Affero General Public License v3.0
7 stars 2 forks source link

Potential security problems #5

Open hackerchai opened 3 years ago

hackerchai commented 3 years ago

Here are potential problems:

  1. The public subscription server is not using HTTPS, besides the default HTTP method is GET. It can be easily MITM attack and cause user's credential leak.
  2. This repo is not using any encryption with user's password, it can be stolen by malwares easily.

Maybe you can consider:

  1. Using nginx/caddy to provide HTTP service with reliable HTTPS, using this repo as an upstream.
  2. Provide user graphical interface (web page frontend) for user. In this way you can change GET method to POST to ensure the security. (Credential information should not using GET method to submit)
  3. Implementing master-key mechanism or not saving password to protect user's password.
0xSeanll commented 3 years ago

Thanks for your feedback.

It is the web crawling process on which this repository emphasizes, and we have no plan of developing it into an application with privacy assurance.