T09 · Insecure Skill Coding Practices
Warning
- Location
rules/calculate-metadata.md:79- Finding
Unrestricted User-Controlled URL Fetching May Enable Server-Side Request Forgery
- Content
View full analysis
= async ({props, abortSignal}) => { const response = await fetch(props.dataUrl, {signal: abortSignal}); const data = await response.json(); return { props: { ...props, fetchedData: data, }, }; }; ``` The related `UrlSource` example accepts an arbitrary source string in the same manner: ```tsx export const canDecode = async (src: string) => { const input = new Input({ formats: ALL_FORMATS, source: new UrlSource(src, { getRetryDelay: () => null, }), }); try { await input.getFormat(); } catch { return false; } const videoTrack = await input.getPrimaryVideoTrack(); if (videoTrack && !(await videoTrack.canDecode())) { return false; } const audioTrack = await input.getPrimaryAudioTrack(); if (audioTrack && !(await audioTrack.canDecode())) { return false; } return true; }; ``` ### Technical Analysis The documented implementation passes `props.dataUrl` directly to `fetch()` without validating the URL scheme, hostname, resolved address, port, or redirect destination. If composition properties can be supplied by an untrusted user and metadata calculation runs in a server-side Remotion renderer, the renderer can be induced to issue requests from its privileged network context. The `UrlSource` helpers have the same trust-boundary issue. They accept arbitrary strings and may perform network requests while parsing media metadata. No controls ...[truncated 1986 chars]- Remediation
View remediation