T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/change.py:297- Finding
Unrestricted URL Retrieval Enables SSRF and Local Resource Access
- Content
View full analysis
bool: """Download an image.""" try: headers = { 'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36' } req = urllib.request.Request(url, headers=headers) with urllib.request.urlopen(req, timeout=30) as response: with open(filepath, 'wb') as f: f.write(response.read()) return True except Exception as e: log_message(f"Download failed: {e}", "ERROR") return False ``` The function is reachable through the user-controlled `--url` command-line option: ```python parser.add_argument("--url", type=str, help="Directly set wallpaper from URL") if args.url: log_message(f"Setting wallpaper from URL: {args.url}") filename = f"wallpaper-{datetime.now().strftime('%Y%m%d-%H%M%S')}.jpg" today_dir = WALLPAPER_DIR / datetime.now().strftime("%Y-%m-%d") today_dir.mkdir(exist_ok=True) filepath = today_dir / filename if download_image(args.url, filepath): size = filepath.stat().st_size log_message(f"Download successful: {filepath} ({size // 1024} KB)") if set_wallpaper_all_displays(filepath): log_message("Wallpaper updated successfully from URL") return 0 ``` ### Technical Analysis The `--url` value is passed directly to `urllib.request.Request` and `urllib.request.urlopen` without validation of: - The URL scheme. - The destination hostname or resolved IP address. - Redirect destinations. - Whether the destination is loopback, link-local, private, or reserved. - The response MIME type or actual file format. - The response size. - Whether the URL refers to a local file rather than a re ...[truncated 2550 chars]- Remediation
View remediation