T09 · Insecure Skill Coding Practices
Error
- Location
scripts/zerohub_image_public.py:121- Finding
Automatic redirects bypass API and download destination validation
- Content
View full analysis
Dict[str, Any]: key = _api_key(True) origin = _base_origin() url = path if path.startswith(("http://", "https://")) else f"{origin}{path}" # API requests must go to the configured zeroHub origin only. This prevents accidental # credential transmission to arbitrary URLs if a path is attacker-controlled. parsed_url = urllib.parse.urlparse(url) parsed_origin = urllib.parse.urlparse(origin) if parsed_url.scheme != "https" or parsed_url.hostname != parsed_origin.hostname: return {"error": "API request host is not allowed", "url": url} body = None headers = {"Authorization": f"Bearer {key}", "Accept": "application/json"} if data is not None: body = json.dumps(data, ensure_ascii=False).encode("utf-8") headers["Content-Type"] = "application/json" req = urllib.request.Request(url, data=body, headers=headers, method=method.upper()) try: with urllib.request.urlopen(req, timeout=timeout) as resp: ``` ```python abs_url = _absolute_url(url) try: safe_url = _validate_url_for_network( abs_url, allowed_hosts=_allowed_hosts(allowed_hosts), allow_http=allow_http, ) except Exception as e: # noqa: BLE001 return {"ok": False, "url": abs_url, "error": str(e)} output_dir.mkdir(parents=True, exist_ok=True) req = urllib.request.Request(safe_url, headers={"User-Agent": "zerohub-image-api/1.0"}) try: with urllib.request.urlopen(req, timeout=timeout) as resp: ``` ### Technical Analysis The code validates only the initial request ...[truncated 2302 chars]- Remediation
View remediation