T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/utils/validator.js:3
- Finding
- Arbitrary URL Downloads Enable Server-Side Request Forgery<![CDATA[ ## Vulnerability Details **File Location**: `scripts/utils/validator.js:3-7`, `scripts/video2text/index.js:97-108`, `scripts/utils/download.js:479-492` **Vulnerability Type**: Server-Side Request Forgery through unrestricted URL fetching and redirects **Risk Level**: Medium ### Vulnerable Code `scripts/utils/validator.js:3-7`: ```js function isUrl(url) { try { const parsedUrl = new URL(url); return parsedUrl.protocol === "http:" || parsedUrl.protocol === "https:"; } catch (_) { return false; } } ``` `scripts/video2text/index.js:97-108`: ```js if (validator.isUrl(file)) { const filepath = utils.downloadPath(); try { await fs.promises.mkdir(filepath, { recursive: true }); } catch (error) { utils.printError("临时下载目录创建失败: " + (error.message || String(error))); process.exit(1); } try { const downloadResult = await helper.download(file, filepath); ``` `scripts/utils/download.js:479-492`: ```js if (this.__isRequireRedirect(response)) { this.__redirectCount++; if (this.__redirectCount > this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, this.url).href; this.__isRedirected = true; this.__initProtocol(redirectedURL); ``` ### Technical Analysis URL validation only verifies that the supplied value uses HTTP or HTTPS. It does not resolve and inspect the destination address or reject loopback, private, link-local, unspecified, multicast, IPv6-local, or cloud metadata addresses. The downloader also follows HTTP redirects without applying destination restrictions to each redirected URL. Consequently, a public URL can redirect to an otherwise internal destination. DNS rebinding may provide another bypass if validation is added only before DNS ...[truncated 1765 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Permit only HTTPS sources unless HTTP support is strictly required. 2. Resolve the hostname before connecting and reject all restricted IPv4 and IPv6 ranges, including: - Loopback addresses. - RFC 1918 private addresses. - Link-local addresses. - IPv4-mapped IPv6 variants. - Unspecified, multicast, and reserved ranges. - Known cloud metadata endpoints. 3. Repeat the complete validation process for every redirect target. 4. Limit redirect depth and reject protocol downgrades from HTTPS to HTTP. 5. Defend against DNS rebinding by connecting only to a previously validated resolved address while preserving the intended TLS server name, or by using an outbound proxy with enforceable destination policy. 6. Where feasible, use an allowlist of supported public video platforms and trusted media hosts. 7. Validate the response `Content-Type` and file signature before upload. 8. Enforce maximum response sizes and download timeouts to reduce resource-exhaustion risk. 9. Do not upload downloaded content unless it has passed media validation. ]]>