T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_data.py:138- Finding
Unvalidated RSS Item URLs Permit Server-Side Request Forgery
- Content
View full analysis
bytes: if timeout is None: timeout = REQUEST_CONFIG["timeout"] normalized_url = url.strip() if _cache: cached = _cache.get(normalized_url) if cached: return cached last_err = None for attempt in range(REQUEST_CONFIG["max_attempts"]): try: response = requests.get( normalized_url, headers=REQUEST_CONFIG["headers"], timeout=timeout, ) response.raise_for_status() content = response.content if _cache: _cache.set(normalized_url, content) return content except Exception as exc: last_err = exc if attempt < len(REQUEST_CONFIG["retry_delays"]): time.sleep(REQUEST_CONFIG["retry_delays"][attempt]) raise NetworkError(f"Network request failed: {last_err}", url=normalized_url) ``` ```python for item in root.iter("item"): title_el = item.find("title") link_el = item.find("link") if title_el is None or link_el is None: continue title = normalize(title_el.text or "") link = (link_el.text or "").strip() if TITLE_KEY not in title: continue label = parse_period(title) if label: items.append((label, link)) ``` ```python for period_label, url in selected_items: try: content = fetch_url(url) except NetworkError: page_failures += 1 continue ``` ### Technical Analysis The initial RSS endpoint is fixed, but each announcement URL is extracted from remotely retrieved XML and passed directly to `requests.get`. The implementation does not verify the URL scheme, ho ...[truncated 2337 chars]- Remediation
View remediation