T09 · Insecure Skill Coding Practices
Error
- Location
scripts/summarize_podcast.py:53- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
list[dict]: """Parse RSS feed and return episodes.""" resp = requests.get(feed_url, timeout=30) resp.raise_for_status() root = ET.fromstring(resp.content) channel = root.find("channel") episodes = [] for item in channel.findall("item"): title = item.findtext("title", "") description = item.findtext("description", "") # Find audio URL enclosure = item.find("enclosure") audio_url = enclosure.get("url") if enclosure is not None else None # Try media:content as fallback if not audio_url: for child in item: if "content" in child.tag.lower() and child.get("url"): audio_url = child.get("url") break ``` ```python def download_audio(url: str, output_path: str) -> bool: """Download audio file.""" print(f"Downloading audio from {url[:80]}...", file=sys.stderr) try: resp = requests.get(url, timeout=300, stream=True) resp.raise_for_status() with open(output_path, "wb") as f: for chunk in resp.iter_content(chunk_size=8192): f.write(chunk) return True ``` ```python elif url.endswith(".xml") or "feed" in url.lower() or "rss" in url.lower(): print("Detected RSS feed", file=sys.stderr) episodes = parse_rss_feed(url) if episodes: episode_info = episodes[args.episode - 1] print(f"Selected episode: {episode_info['title']}", file=sys.stderr) elif url.endswith(".mp3") or url.endswith(".m4a"): pri ...[truncated 3070 chars]- Remediation
View remediation