T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wechat_reader.py:207- Finding
Missing URL Validation Enables Server-Side Request Forgery
- Content
View full analysis
dict: """ 解析微信 URL，提取关键信息 Args: url: 微信公众号文章链接 Returns: 包含 URL 信息的字典 """ # 微信文章 URL 模式 patterns = [ r'https?://mp\.weixin\.qq\.com/s/([a-zA-Z0-9_-]+)', # 直接文章 ID r'https?://mp\.weixin\.qq\.com/s\?([a-zA-Z0-9&=_-]+)', # 带参数的 URL r'https?://mp\.weixin\.qq\.com/profile/([a-zA-Z0-9_-]+)', # 公众号主页 ] result = { "original_url": url, "type": "unknown", "article_id": None, "params": {} } # 提取文章 ID match = re.search(r'/s/([a-zA-Z0-9_-]+)', url) if match: result["type"] = "article" result["article_id"] = match.group(1) # 提取 URL 参数 if '?' in url: query_string = url.split('?')[1] params = {} for param in query_string.split('&'): if '=' in param: key, value = param.split('=', 1) params[key] = value result["params"] = params return result ``` ```python def fetch_article(url: str, use_browser: bool = True) -> dict: """ 获取微信文章内容 Args: url: 微信公众号文章链接 use_browser: 是否使用浏览器模式（更稳定但更慢） Returns: 包含文章内容的字典 """ # 先解析 URL url_info = parse_wechat_url(url) print(f"解析 URL: {json.dumps(url_info, ensure_ascii=False, indent=2)}", file=sys.stderr) if use_browser and PLAYWRIGHT_AVAILABLE: return fetch_article_with_playwright(url) else: return fetch_article_with_requests(url) ``` ### Technical Analysis The Skill is documented as accepting only WeChat article URLs under `mp.weixin.qq.com`. Although `parse_wechat_url()` defines several expected URL patterns, the `patterns` list is never used to validate or rej ...[truncated 2561 chars]- Remediation
View remediation
` or `/s` with expected query parameters. 3. Resolve the hostname and reject any destination resolving to loopback, private, link-local, multicast, reserved, or otherwise non-public addresses using Python's `ipaddress` module. 4. Prevent DNS rebinding by ensuring the validated address is the address used for the connection, or enforce destination restrictions at an outbound proxy or firewall. 5. Disable automatic redirects or validate the scheme, hostname, port, and resolved address of every redirect destination before following it. 6. In Playwright mode, intercept navigation and subresource requests with routing rules and abort requests to all origins except an explicit allowlist. 7. Reject malformed, unknown, or unsupported URLs rather than merely recording `"type": "unknown"`. 8. Add tests covering localhost, private IPv4 and IPv6 ranges, link-local metadata addresses, encoded hostnames, user-information tricks, alternate ports, protocol-relative URLs, and redirect chains. ]]>