T09 · Insecure Skill Coding Practices
Error
- Location
scripts/publish_wechat.py:215- Finding
Arbitrary URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
Article: resp = requests.get(url, timeout=30) resp.raise_for_status() ``` ```python def upload_image_from_url(self, token: str, image_url: str) -> str: img = requests.get(image_url, timeout=self.timeout) img.raise_for_status() content_type = img.headers.get("Content-Type", "image/jpeg") if not content_type.startswith("image/"): return "" ``` ```python def upload_content_image_from_url(self, token: str, image_url: str) -> str: img = requests.get(image_url, timeout=self.timeout) img.raise_for_status() content_type = img.headers.get("Content-Type", "image/jpeg") if not content_type.startswith("image/"): return "" ``` ```python # Upload a network image to the material library if args.upload_material_url: wechat_cfg = get_account_config(cfg, args.account.strip() or None) app_id = (wechat_cfg.get("app_id") or "").strip() app_secret = (wechat_cfg.get("app_secret") or "").strip() if not app_id or not app_secret: raise RuntimeError("Configuration is missing app_id or app_secret") client = WeChatClient(app_id=app_id, app_secret=app_secret, timeout=args.timeout) token = client.get_token() media_id = client.upload_image_from_url(token, args.upload_material_url.strip()) ``` ```python if is_url(input_value): article = extract_from_url(input_value) ``` ### Technical Analysis The command-line input, network image arguments, and image URLs extracted from article content are passed directly to `requests.get`. The implementation does not: - Reject loopback, private, link-local, reserved, multicast, or cloud metadata addresses. - Resolve hostnames and va ...[truncated 1961 chars]- Remediation
View remediation