T09 · Insecure Skill Coding Practices
Error
- Location
scripts/podcast.sh:21- Finding
Unrestricted URL Fetching and Arbitrary File Overwrite
- Content
View full analysis
d+=c);process.stdin.on('end',()=>{ const items=d.match(/[\s\S]*?<\/item>/g)||[]; items.slice(0,parseInt(process.argv[1])).forEach((item,i)=>{ const title=item.match(/(?:<!\[CDATA\[)?(.*?)(?:\]\]>)?<\/title>/)?.[1]||'untitled'; const url=item.match(/enclosure[^>]*url=\"([^\"]*)\"/)?.[1]||'no url'; const date=item.match(/<pubDate>(.*?)<\/pubDate>/)?.[1]||''; console.log((i+1)+'. '+title); console.log(' Date: '+date); console.log(' URL: '+url); console.log(''); }); })" "$LIMIT" ;; download) URL="${2:?Usage: podcast.sh download MP3_URL OUTPUT_PATH}" OUTPUT="${3:?}" echo "Downloading to ${OUTPUT}..." curl -sL -o "$OUTPUT" "$URL" SIZE=$(ls -lh "$OUTPUT" | awk '{print $5}') echo "Done. Size: ${SIZE}" ;; ``` ### Technical Analysis Both modes pass an unrestricted, caller-controlled URL directly to `curl`. No validation limits the scheme, destination hostname, resolved IP address, port, or redirect destination. Because redirects are enabled with `-L`, validation of only the initial URL would also be insufficient. Depending on the protocols enabled in the installed `curl`, this may permit requests to: - Loopback services such as `127.0.0.1` or `localhost` - Private network services - Link-local and cloud instance metadata services - Non-HTTP resources, including local `file://` URLs - Redirect destinations that differ from the originally supplied host The `download` operation additionally accepts an unrestricted output path and invokes `curl -o` without check ...[truncated 1442 chars]- Remediation
View remediation