T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/utils/validator.js:3
- Finding
- Unrestricted URL Downloading Enables Server-Side Request Forgery and Resource Exhaustion<![CDATA[ ## Vulnerability Details **File Location**: `scripts/utils/validator.js:3-10`; data flow continues through `scripts/video2text/index.js:96-114` and `scripts/utils/helper.js:27-39` **Vulnerability Type**: Server-Side Request Forgery (SSRF), unrestricted network access, and unbounded resource consumption **Risk Level**: Medium ### Vulnerable Code `scripts/utils/validator.js:3-10`: ```js function isUrl(url) { try { const parsedUrl = new URL(url); return parsedUrl.protocol === "http:" || parsedUrl.protocol === "https:"; } catch (_) { return false; } } ``` `scripts/video2text/index.js:96-114`: ```js if (validator.isUrl(file)) { const filepath = utils.downloadPath(); try { await fs.promises.mkdir(filepath, { recursive: true }); } catch (error) { utils.printError("临时下载目录创建失败: " + (error.message || String(error))); process.exit(1); } try { const downloadResult = await helper.download(file, filepath); let tempFilePath = downloadResult?.filePath || ""; if (tempFilePath === "") { utils.printError("下载失败: 未返回文件路径"); process.exit(1); } ``` `scripts/utils/helper.js:27-39`: ```js async function download(url, path) { return new Promise((resolve, reject) => { const options = { retry: { maxRetries: constants.CREATE_MAX_ATTEMPTS, delay: constants.RETRY_INTERVAL, }, override: { skip: true, skipSmaller: true }, }; let progressLog = ""; const dl = new Downloader(url, path, options); ``` ### Technical Analysis The URL validator only confirms that the input parses as an HTTP or HTTPS URL. It does not resolve and inspect the destination address, restrict destination hosts, or reject loopback, private, link-local, multicast, and cloud metadata address ranges. The accepted URL is passed directly to the downloader. The reviewed configuration also does not impose a maximum response size. Consequently, any party able to influence the `--file` argument c ...[truncated 2037 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer an explicit allowlist of supported public media domains. 2. Require HTTPS unless HTTP support is essential. 3. Resolve the hostname before connecting and reject all loopback, private, link-local, multicast, unspecified, reserved, and cloud metadata address ranges for both IPv4 and IPv6. 4. Protect against DNS rebinding by connecting only to the validated resolved address while preserving the expected hostname for TLS verification. 5. Disable automatic redirects or validate every redirect destination using the same hostname and resolved-address policy. 6. Enforce strict limits on: - Maximum response size. - Maximum download duration. - Maximum redirect count. - Connection and idle timeouts. 7. Validate `Content-Type` against supported media formats, while also verifying file signatures because HTTP headers are attacker-controlled. 8. Abort and delete partial files immediately when a size, type, redirect, or timeout policy is violated. 9. Run network downloads in a restricted environment with egress filtering that blocks internal and metadata networks. ]]>