T09 · Insecure Skill Coding Practices
Error
- Location
scripts/image_downloader.py:79- Finding
Unrestricted Media URL Fetching Enables Server-Side Request Forgery and Resource Exhaustion
- Content
View full analysis
str: """ Download a single image and return the local file path. Args: url: Image URL to download referer: Optional Referer header. If None, auto-generates from URL domain. Raises requests.RequestException on network errors. """ # Build headers with Referer to bypass hotlink protection parsed = urlparse(url) if referer is None: referer = f"{parsed.scheme}://{parsed.netloc}/" headers = { "Referer": referer, "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36", } resp = requests.get(url, timeout=DEFAULT_TIMEOUT, stream=True, headers=headers) resp.raise_for_status() ext = self._guess_extension(url, resp.headers.get("Content-Type")) filename = f"{uuid.uuid4().hex[:12]}{ext}" filepath = os.path.join(self.temp_dir, filename) with open(filepath, "wb") as f: for chunk in resp.iter_content(chunk_size=8192): f.write(chunk) def download_video(self, url: str, referer: str | None = None) -> str: """ Download a single video and return the local file path. Args: url: Video URL to download referer: Optional Referer header. If None, auto-generates from URL domain. Raises requests.RequestException on network errors. """ parsed = urlparse(url) if referer is None: referer = f"{parsed.scheme}://{parsed.netloc}/" headers = { "Referer": referer, "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36", } re ...[truncated 3930 chars]- Remediation
View remediation