T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_xiaohongshu_notes.py:59- Finding
Unrestricted URL Fetching Can Disclose Xiaohongshu Cookies and Enable SSRF
- Content
View full analysis
str: headers = {"User-Agent": UA, "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8"} if cookie: headers["Cookie"] = cookie req = request.Request(url=url, headers=headers) with request.urlopen(req, timeout=timeout) as resp: return resp.read().decode("utf-8", errors="ignore") ``` The associated command-line and request flow is: ```python parser.add_argument("--url", help="Single Xiaohongshu note URL.") parser.add_argument("--url-file", help="File containing note URLs, one per line.") parser.add_argument("--cookie", help="Raw cookie header value.") parser.add_argument("--cookie-file", help="Read cookie header value from file.") parser.add_argument("--format", choices=["json", "md", "both"], default="json") parser.add_argument("--output", default="xhs_notes.json", help="Output path for JSON.") parser.add_argument("--timeout", type=int, default=20, help="HTTP timeout in seconds.") args = parser.parse_args() if not args.url and not args.url_file: parser.error("Provide at least one of --url or --url-file.") cookie = args.cookie if args.cookie_file: cookie = Path(args.cookie_file).read_text(encoding="utf-8").strip() urls = read_urls(args.url, args.url_file) if not urls: parser.error("No valid URLs found.") records: List[NoteRecord] = [] for url in urls: try: html = fetch_html(url, timeout=args.timeout, cookie=cookie) ``` ### Technical Analysis The script accepts arbitrary URLs from either `--url` or `--url-file` and passes them directly to `urllib.request.urlopen`. It does not validate: - The URL scheme. - The normalized destination hostname. - Whether the resolved address is public, private, loopback, link-local, ...[truncated 2282 chars]- Remediation
View remediation