T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/main.py:753
- Finding
- Authentication Cookies May Be Disclosed to Unvalidated Article Destinations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:753-758`, `scripts/main.py:1030-1064` **Vulnerability Type**: Authentication cookie disclosure through an unrestricted HTTP client **Risk Level**: High ### Vulnerable Code ```python def build_async_client(cookies: dict[str, str]) -> httpx.AsyncClient: return httpx.AsyncClient( headers=base_headers(), cookies=cookies, follow_redirects=True, timeout=httpx.Timeout(30.0, connect=30.0), ) ``` ```python async def download_articles( *, cookies: dict[str, str], articles: list[dict[str, Any]], output_dir: Path, account: dict[str, Any], concurrency: int, ) -> list[dict[str, Any]]: semaphore = asyncio.Semaphore(max(concurrency, 1)) async with build_async_client(cookies) as client: tasks = [ download_single_article( client=client, semaphore=semaphore, index=index, article=article, output_dir=output_dir, account=account, ) for index, article in enumerate(articles, start=1) ] return await asyncio.gather(*tasks) async def download_single_article( *, client: httpx.AsyncClient, semaphore: asyncio.Semaphore, index: int, article: dict[str, Any], output_dir: Path, account: dict[str, Any], ) -> dict[str, Any]: async with semaphore: try: response = await client.get(article["link"]) response.raise_for_status() parsed = parse_article_content(response.text, article) ``` ### Technical Analysis The asynchronous HTTP client is initialized with cookies extracted from the authenticated WeChat browser session. These cookies are supplied as a plain name-to-value dictionary instead of cookie objects with explicit domain and path restrictions. The same authenticated client is then used to request every URL found in `a ...[truncated 1874 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use a separate, cookie-free HTTP client for downloading public article content. 2. Before every request, validate the URL: - Require the `https` scheme. - Require an exact approved hostname such as `mp.weixin.qq.com`. - Reject embedded credentials, nonstandard ports, malformed hosts, and unsupported URL forms. 3. Disable automatic redirects or inspect every redirect target before following it. 4. Reject redirects that cross the approved origin. 5. Preserve domain and path attributes when copying cookies from Playwright instead of reducing them to a plain dictionary. 6. Attach authentication cookies only to requests that explicitly require them. 7. Consider resolving destinations and blocking loopback, link-local, private, and metadata-service addresses to prevent SSRF if broader host support is introduced. 8. Add tests covering external links, cross-origin redirects, HTTP downgrade redirects, and cookie non-disclosure. ]]>