T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:100
- Finding
- Unrestricted User-Controlled URL Fetching Enables SSRF<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:100-106`; related implementation flow in `core/analyzer.py:82-92, 118-134` **Vulnerability Type**: Server-Side Request Forgery through unrestricted URL fetching **Risk Level**: Medium ### Vulnerable Code `SKILL.md:100-106`: ```text Input: Article URL ↓ Main Agent smart routing (single-article mode) ├─ web_fetch retrieves content ├─ Analyze content + quality scoring ├─ Generate detailed report ├─ feishu_create_doc creates a document └─ feishu_bitable archives it to Bitable ``` `core/analyzer.py:82-92`: ```python # 2. Fetch content if it was not provided if title is None or content is None: fetched = self._fetch_content(url) if title is None: title = fetched.get("title", "") if content is None: content = fetched.get("content", "") ``` `core/analyzer.py:118-134`: ```python def _fetch_content(self, url: str) -> dict: """ Fetch article content Args: url: Article URL Returns: dict: {"title": str, "content": str} """ # This calls OpenClaw's web_fetch or browser tool. # The actual implementation requires integration with the OpenClaw tool system. return { "title": "", "content": "" } ``` ### Technical Analysis The Skill instructs the hosting Agent to pass an article URL to `web_fetch` or a browser tool. The URL originates from the user, but the reviewed workflow does not require validation of: - The URL scheme. - The destination hostname. - The resolved IP address. - Redirect destinations. - Loopback, link-local, private, reserved, or multicast address ranges. - Response size and request duration. Although retrieving remote articles is necessary for the declared functionality, unrestricted destination access exceeds the minimum network privilege needed to fetch public articles. The Python method is currently a placeholder rather than a direct network implementation. However, the opera ...[truncated 1795 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Implement a centralized URL-validation layer before every `web_fetch` or browser invocation: 1. Accept only `https` and, where explicitly required, `http`. 2. Reject URLs containing embedded credentials or malformed authority components. 3. Resolve the destination hostname and reject every address in loopback, private, link-local, multicast, unspecified, reserved, and documentation-only ranges. 4. Apply the same validation after every DNS resolution and to every redirect destination. 5. Consider an allowlist of supported public article domains. 6. Disable non-HTTP protocols, including `file`, `ftp`, `gopher`, and custom schemes. 7. Configure strict connection, read, and total timeouts. 8. Enforce response-size and content-type limits. 9. Run fetching through an isolated egress proxy that cannot access internal networks or cloud metadata. 10. Do not automatically archive fetched data until the destination and response have passed validation. 11. Add tests for IPv4, IPv6, alternative IP representations, DNS rebinding, and redirect-based bypasses. ]]>