T09 · Insecure Skill Coding Practices
Warning
- Location
ppt-master-assets/scripts/web_to_md.py:82- Finding
Arbitrary URL Fetching with Disabled TLS Certificate Verification
- Content
View full analysis
str: """Fetch a web page with explicit headers and encoding detection. Args: url: Target URL. Returns: The response body as text. """ headers = { "User-Agent": CONFIG["user_agent"], "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8" } try: response = requests.get(url, headers=headers, timeout=CONFIG["timeout"], verify=False) response.raise_for_status() # Enhanced encoding detection (requests handles this well usually, but we force apparent_encoding for Chinese) response.encoding = response.apparent_encoding return response.text except Exception as e: raise Exception(f"Failed to fetch {url}: {str(e)}") ``` Embedded image URLs derived from remote HTML are also fetched with TLS verification disabled: ```python abs_url = urljoin(page_url, src) if abs_url in downloaded: saved_name = downloaded[abs_url] else: try: resp = requests.get( abs_url, headers={"User-Agent": CONFIG["user_agent"]}, timeout=CONFIG["timeout"], verify=False, ) resp.raise_for_status() filename = build_image_filename( abs_url, idx, resp.headers.get("Content-Type")) ``` ### Technical Analysis The web conversion utility accepts arbitrary URLs and passes them directly to `requests.get()`. It does not validate: ...[truncated 2999 chars]- Remediation
View remediation