T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/enrich_xiaoyuzhou.py:88- Finding
Arbitrary URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
Dict[str, Any]: request = Request( url, headers={ "User-Agent": USER_AGENT, "Accept": "text/html,application/xhtml+xml", "Accept-Encoding": "gzip", "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8", }, ) with urlopen(request, timeout=30) as response: content_encoding = (response.getheader("Content-Encoding") or "").lower() decompressor = zlib.decompressobj(16 + zlib.MAX_WBITS) if "gzip" in content_encoding else None chunks: List[bytes] = [] total_read = 0 while total_read < MAX_READ_BYTES: raw_chunk = response.read(READ_CHUNK_SIZE) if not raw_chunk: break total_read += len(raw_chunk) chunk = decompressor.decompress(raw_chunk) if decompressor else raw_chunk if chunk: chunks.append(chunk) payload = extract_next_data_from_html_bytes(b"".join(chunks)) if payload is not None: return payload raise ValueError("Could not find __NEXT_DATA__ within the read limit.") ``` ```python def extract_urls_from_payload(payload: Any) -> List[str]: if isinstance(payload, list): items = payload elif isinstance(payload, dict): items = payload.get("items", []) else: return [] urls: List[str] = [] for item in items: if isinstance(item, str): urls.append(item) continue if not isinstance(item, dict): continue if item.get("kind") == "episode" and item.get("episodeUrl"): urls.append(item["episodeUrl"]) ...[truncated 3647 chars]- Remediation
View remediation