T09 · Insecure Skill Coding Practices
Error
- Location
scripts/publish_wechat.py:107- Finding
Article Image Sources Can Exfiltrate Arbitrary Local Files
- Content
View full analysis
Tuple[bytes, str, str]: if source.startswith("data:"): header, encoded = source.split(",", 1) mime_match = re.match(r"data:([^;]+);base64", header, re.I) mime_type = mime_match.group(1) if mime_match else "application/octet-stream" suffix = mimetypes.guess_extension(mime_type) or ".bin" return base64.b64decode(encoded), f"inline{suffix}", mime_type if re.match(r"^https?://", source, re.I): req = urllib.request.Request(source, headers={"User-Agent": USER_AGENT}) with urllib.request.urlopen(req, timeout=30) as resp: payload = resp.read() content_type = resp.headers.get_content_type() parsed = urllib.parse.urlparse(source) filename = Path(parsed.path).name or f"remote{mimetypes.guess_extension(content_type) or '.bin'}" return payload, filename, content_type or detect_content_type(filename) path = Path(source) payload = path.read_bytes() return payload, path.name, detect_content_type(path.name) ``` ```python def replace_body_images(access_token: str, html_text: str, proxy_origin: Optional[str], dry_run: bool) -> str: cache: Dict[str, str] = {} def repl(match: re.Match) -> str: original = match.group(1).strip() if original in cache: replacement = cache[original] elif dry_run: replacement = original cache[original] = replacement else: replacement = upload_inline_image(access_token, original, proxy_origin) cache[original] = replacement return match.group(0).replace(original, replacement, 1) return re.sub ...[truncated 2623 chars]- Remediation
View remediation