T09 · Insecure Skill Coding Practices
Error
- Location
processors/image_processor.py:68- Finding
Unvalidated Image URLs Enable Server-Side Request Forgery and Response Exfiltration to OSS
- Content
View full analysis
List[str]: images: List[str] = [] seen = set() for img in container.find_all('img'): ds = (img.get('data-src') or '').strip() src = (img.get('src') or '').strip() real = ds or src if not real or real.startswith('data:image'): continue real = real.split('?')[0] img['src'] = real if 'data-src' in img.attrs: del img['data-src'] if real in seen: continue seen.add(real) images.append(real) logger.debug(f"Extracted {len(images)} images") return images ``` ```python # main.py:37-45 image_urls = article_data.get('images', []) if image_urls: logger.info(f"Found {len(image_urls)} images; starting upload") url_mapping = image_processor.upload_images( image_urls, platform, article_id, article_url=url ) ``` ```python # processors/image_processor.py:42-44 response = self._download_image(img_url, platform_referer) result = self.bucket.put_object(oss_path, response.content) ``` ```python # processors/image_processor.py:68-80 @staticmethod def _download_image(img_url: str, fallback_referer: str): try: resp = requests.get(img_url, timeout=30) if resp.status_code != 403: resp.raise_for_status() return resp except requests.HTTPError: pass if fallback_referer: resp = requests.get( img_url, headers={'Referer': fallback_referer}, timeout=30 ) resp.raise_for_status() return resp raise RuntimeError(f"I ...[truncated 2539 chars]- Remediation
View remediation