T09 · Insecure Skill Coding Practices
Error
- Location
runtime.py:215- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
tuple[str, str]: probe = fetch_page(url, timeout=30) access_meta = classify_page(source_url=url, html_text=probe["html"], final_url=probe["final_url"]) ``` ### Technical Analysis `load_article_html()` passes the supplied URL directly to `fetch_page()` before performing any visible validation of its scheme, hostname, port, resolved IP address, or redirect destination. Although the documentation describes the input as a public `mp.weixin.qq.com` article URL, this restriction is not enforced in the audited code before the network request occurs. Classification after fetching does not prevent the initial request from reaching an unauthorized destination. The implementation also relies on the external `skill_runtime.wechat_access.fetch_page` function for redirect handling. Because that dependency was not included in the supplied project, the audit could not establish that redirects are restricted or that private and reserved network addresses are rejected. ### Attack Path 1. An attacker supplies an input URL pointing to an internal or otherwise restricted HTTP service. 2. The skill passes the URL directly to `fetch_page(url, timeout=30)`. 3. The Agent host sends the request using its own network access. 4. The target can be a loopback service, private network host, link-local cloud metadata endpoint, or another service inaccessible to the attacker directly. 5. The response is passed into page classification and may subsequently be processed, archived, reflected through generated content, or differentiated through errors and timing behavior. 6. Redirects may provide an additional bypass if the initial public URL redirects to a prohibited address and the shared fetch function does not revalidate each destination. ...[truncated 715 chars]- Remediation
View remediation