T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/amazon_review_workbook.py:210- Finding
Unvalidated URL Host Enables Arbitrary Navigation in a Logged-In Browser Profile
- Content
View full analysis
tuple[str, str]: parsed = urlparse(url) match = re.search( r"/(?:dp|gp/product|product-reviews)/([A-Z0-9]{10})", parsed.path, re.I ) if not match: raise ValueError(f"Unable to parse an ASIN from URL: {url}") host = parsed.netloc or "www.amazon.com" return match.group(1).upper(), host def build_review_url(host: str, asin: str) -> str: return f"https://{host}/product-reviews/{asin}/ref=cm_cr_dp_d_show_all_btm?ie=UTF8" ``` ```python def navigate(self, url: str) -> None: self.send("Page.navigate", {"url": url}, timeout=20) time.sleep(4) ``` ```python asin, host = parse_product_url(url) review_url = build_review_url(host, asin) ``` ```python combo_url = f"https://{host}/product-reviews/{asin}/ref=cm_cr_dp_d_show_all_btm?ie=UTF8&{combo_params}" ``` ```python combo_url = f"https://{host}/product-reviews/{asin}/ref=cm_cr_dp_d_show_all_btm?ie=UTF8&{kw_params}" ``` ### Technical Analysis The URL parser verifies that the path contains a syntactically valid ten-character ASIN, but it accepts `parsed.netloc` without confirming that the hostname belongs to Amazon. The accepted host is subsequently interpolated into URLs that are opened through the Chrome DevTools Protocol. Consequently, a URL such as `https://attacker.example/dp/B012345678` satisfies the ASIN path requirement. The resulting review URL points to `attacker.example`, not Amazon. The browser connection also selects the first available Chrome page target. The documented setup recommends using a ...[truncated 2053 chars]- Remediation
View remediation