T09 · Insecure Skill Coding Practices
Error
- Location
tools/NewsFetcher.ts:35- Finding
Arbitrary News Source URLs Permit Server-Side Request Forgery
- Content
View full analysis
p.trim()); if (parts.length !== 4) { throw new Error('参数格式错误，示例："新智元,https://xinzhiyuan.ai/feed,rss,AI"'); } const [name, url, type, category] = parts; if (!name || !url) { throw new Error('新闻源 name 与 url 不能为空'); } if (type !== 'rss' && type !== 'web') { throw new Error('type 只能为 rss 或 web'); } ``` `tools/NewsFetcher.ts:35-53` subsequently requests the configured URL: ```ts private async fetchFromRSS(source: NewsSource): Promise { const feed = await parser.parseURL(source.url); return feed.items.map(item => ({ title: item.title || '', link: item.link || '', pubDate: new Date(item.pubDate || Date.now()), description: item.contentSnippet || item.content, source: source.name, category: source.category, })); } private async fetchFromWeb(source: NewsSource): Promise { const response = await fetch(source.url); const html = await response.text(); ``` ### Technical Analysis The news-source URL is configuration-controlled and reaches network request functions without destination validation. There is no enforcement of HTTPS, no hostname allowlist, no rejection of loopback or private network ranges, no DNS rebinding defense, and no redirect validation. Although `workflows/FetchNews.md` describes a trusted-domain filter, the executable implementation does not apply such a filter. An attacker who can influence the configuration or persuade a user or Agent to add a source can therefore make the pr ...[truncated 1796 chars]- Remediation
View remediation