T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/codex-radar-check.py:44- Finding
Untrusted Remote Data Is Forwarded to an AI Agent Without Validation
- Content
View full analysis
dict: """GET *url*, parse JSON, return dict. Raises on failure.""" req = urllib.request.Request( url, headers={"User-Agent": "codex-radar-check/1.0", "Accept": "application/json"}, ) with urllib.request.urlopen(req, timeout=REQUEST_TIMEOUT) as resp: raw = resp.read() return json.loads(raw) ``` Remotely supplied strings are copied into event descriptions and output fields. Representative affected code includes: ```python # --- window_open boolean --- was = bool(prev.get("window_open")) now = bool(curr.get("window_open")) if was != now: last_win = raw_data.get("last_window") or {} opened_at = last_win.get("opened_at") or raw_data.get("checked_at") scope = last_win.get("scope") or "Codex 用户" if now: events.append( { "type": "window_opened", "detail": "Codex 用量重置窗口已开启", "opened_at": opened_at, "scope": scope, } ) else: events.append( {"type": "window_closed", "detail": "Codex 用量重置窗口已关闭"} ) # --- status string --- old_status = str(prev.get("status") or "") new_status = str(curr.get("status") or "") if old_status != new_status: events.append( { "type": "status_change", "detail": f"状态从 {old_status} 变为 {new_status}", "from": old_status, "to": new_status, } ) # --- current_window.state --- old_cws = str(prev.get("current_window_state") or "") new_cws = str(curr.get("current_window_stat ...[truncated 4433 chars]- Remediation
View remediation