T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/indexnow-ping.js:137- Finding
Unvalidated URLs Are Submitted Under the Configured IndexNow Host Identity
- Content
View full analysis
0 ? cliUrls : urlsFromSitemap(); if (urls.length === 0) { console.log('[indexnow] No URLs to submit. Exiting.'); return; } ``` ### Technical Analysis The script accepts URLs directly from command-line arguments or extracts them from sitemap `` elements. It then places those values into the IndexNow `urlList` without parsing or validating them. No local check ensures that: - Each entry is a syntactically valid URL. - The scheme is restricted to `http:` or `https:`. - The URL hostname matches `INDEXNOW_HOST`. - Embedded URL credentials are prohibited. - Subdomains are accepted only under an explicit policy. - `INDEXNOW_HOST` itself is a valid hostname rather than an unexpected string. The network destination is fixed to `api.indexnow.org`, so this issue does not provide conventional server-side request forgery or arbitrary outbound-network access. However, the missing validation violates the documented trust boundary that the script submits only the operator's own public URLs. The remote IndexNow service may reject unrelated URLs, but remote validation should not replace local input validation. ### Attack Path 1. An attacker gains control over a sitemap consumed through `SITEMAP_PATH`, or over arguments supplied to `scripts/indexnow-ping.js` by build automation. 2. The attacker adds URLs belonging to unrelated domains, malformed URLs, or URLs using unsupported schemes. 3. The script accepts the entries without validation: ```bash node scripts/indexnow-ping.js https://unrelated.example/page ``` 4. The script constructs a ...[truncated 1227 chars]- Remediation
View remediation