T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/web_search_fallback.py:97- Finding
Unrestricted Search-Result Fetching Enables Server-Side Request Forgery
- Content
View full analysis
{e}", file=sys.stderr) return "" def fetch_page_content(url, max_length=5000): """Fetch page body text (for --fetch-content).""" html = fetch_url(url, timeout=20) if not html: return "" html = re.sub( r"]*>.*?", "", html, flags=re.DOTALL | re.IGNORECASE, ) html = re.sub( r"]*>.*?", "", html, flags=re.DOTALL | re.IGNORECASE, ) text = html_to_text(html) text = re.sub(r"\s+", " ", text).strip() return text[:max_length] ``` The unvalidated function is invoked on URLs extracted from external search-engine responses: ```python if args.fetch_content and unique_results: fetch_limit = min(args.fetch_limit, len(unique_results)) print( f"\n[FALLBACK] Fetching content for top {fetch_limit} results...", file=sys.stderr, ) for i, r in enumerate(unique_results[:fetch_limit]): print( f"[FALLBACK] ({i+1}/{fetch_limit}) {r['url']}", file=sys.stderr, ) r["content"] = fetch_page_content(r["url"]) time.sleep(0.5) ``` ### Technical ...[truncated 3029 chars]- Remediation
View remediation