T09 · Insecure Skill Coding Practices
Error
- Location
scripts/tensorslab_video.py:70- Finding
Unvalidated API-Controlled Video URL Enables Server-Side Request Forgery and Unbounded Downloads
- Content
View full analysis
bool: """Download a video from URL to local path.""" try: response = _SESSION.get(url, timeout=300, stream=True) response.raise_for_status() total_size = int(response.headers.get('content-length', 0)) with open(output_path, 'wb') as f: if total_size > 0: downloaded = 0 for chunk in response.iter_content(chunk_size=8192): if chunk: f.write(chunk) downloaded += len(chunk) percent = (downloaded / total_size) * 100 logger.info(f"\r📥 Downloading: {percent:.1f}%") else: f.write(response.content) logger.info(f"\r✅ Download complete: {output_path}") return True except Exception as e: logger.warning(f"\r⚠️ Failed to download video from {url}: {e}") return False ``` The URL passed into this function comes directly from the task-status API response: ```python urls = task_data.get("url", []) if not urls: logger.warning("⚠️ No videos returned") return downloaded_files for i, url in enumerate(urls): url_path = urlparse(url).path ext = Path(url_path).suffix if not ext or len(ext) > 5: ext = ".mp4" filename = f"{task_id}_{i}{ext}" output_path = output_dir / filename logger.info(f"📥 Downloading video {i+1}/{len(urls)}: {output_path}") if download_video(url, output_path): downloaded_files.append(str(output_path)) ``` ### Technical Analysis The client trusts download URLs supplied by the remote task-status service and sends requests to them without validating the URL scheme, hostname, res ...[truncated 2027 chars]- Remediation
View remediation