T09 · Insecure Skill Coding Practices
Error
- Location
scripts/creel_report.py:631- Finding
Unrestricted Subscriber List URLs Permit Server-Side Request Forgery
- Content
View full analysis
Sheet) and extract unique emails. Layout-agnostic: pulls every email-looking cell. Fails soft (returns [] on error).""" if not url: return [] try: raw = fetch(url) except Exception as e: # noqa: BLE001 sys.stderr.write(f"list fetch failed ({url}), skipping: {e}\n") return [] seen, out = set(), [] for m in EMAIL_RE.finditer(raw): e = m.group(0) if e.lower() not in seen: seen.add(e.lower()) out.append(e) return out ``` ```python else: subscribers = load_subscribers(c.get("subscribers_url")) unsub = {e.lower() for e in load_subscribers(c.get("unsubscribe_url"))} ``` ### Technical Analysis The values of `subscribers_url` and `unsubscribe_url` are taken from the external email credentials configuration and passed directly to `urllib.request.urlopen`. The implementation does not validate: - The URL scheme. - The destination hostname or resolved IP address. - Whether the destination is loopback, private, reserved, or link-local. - Whether an HTTP redirect changes the request to a prohibited destination. - The response content type or maximum response size. The declared functionality only requires retrieving published ...[truncated 1677 chars]- Remediation
View remediation