T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/gate_cli.py:132- Finding
Redirects Bypass the Declared HTTPS and Domain Allowlist
- Content
View full analysis
dict[str, Any]: if not https_only(url): return {"ok": False, "status": 0, "error": "https_only", "bytes": 0, "sha256": None} req = urllib.request.Request(url, headers={"User-Agent": UA}, method="GET") try: with urllib.request.urlopen(req, timeout=timeout) as resp: ``` ### Technical Analysis The `https_only()` check validates only the initial endpoint. Python's `urllib.request.urlopen()` follows supported HTTP redirects automatically, but the code does not validate the scheme or hostname of each redirect destination. Consequently, an initially trusted HTTPS endpoint can redirect the request to an unlisted host or potentially a non-HTTPS destination. This violates the Skill's documented fixed-domain and HTTPS-only trust boundary. The request contains only a static User-Agent and does not include credentials, proposal fields, environment contents, or local files. Therefore, this issue does not establish sensitive-data exfiltration, but it does permit outbound communication beyond the declared destination allowlist. ### Attack Path 1. An attacker compromises one of the fixed endpoints, its hosting account, or an upstream component capable of controlling its redirects. 2. The endpoint returns an HTTP redirect to an attacker-controlled or otherwise unapproved destination. 3. `urllib.request.urlopen()` follows that redirect automatically. 4. The host makes an undeclared outbound request and discloses its source IP, timing information, and static User-Agent to the destination. 5. If a redirect downgrades transport, the Skill's documented HTTPS-only guarantee is also lost. ### Impact Assessment The attacker does not gain code execution, filesystem access, credentials, or elevated local privi ...[truncated 290 chars]- Remediation
View remediation