T09 · Insecure Skill Coding Practices
Error
- Location
scripts/used_price_compare/fetcher.py:20- Finding
Weak Marketplace Hostname Validation Allows Navigation to Attacker-Controlled Origins
- Content
View full analysis
tuple[str, str] | None: """Determine which bb-browser adapter to use for a given URL.""" try: host = urlparse(url).hostname or "" except Exception: return None for pattern, adapter, label in _PLATFORM_RULES: if re.search(pattern, host): return adapter, label return None ``` The accepted URL is subsequently passed unchanged to an adapter: ```javascript async function(args) { if (!args.url) return { error: 'Missing argument: url' }; const resp = await fetch(args.url, { credentials: 'include' }); if (!resp.ok) return { error: `HTTP ${resp.status}`, hint: 'Check if the listing URL is valid' }; ``` ### Technical Analysis The eBay and Amazon patterns are substring checks rather than registrable-domain checks. A hostname such as `shop.ebay.attacker.example` contains `.ebay.` and is therefore accepted as eBay, despite being controlled by an attacker. The same weakness applies to names containing `.amazon.`. The accepted URL is opened in the bb-browser context with `credentials: 'include'`. Browser cookie scoping should ordinarily prevent actual eBay or Amazon cookies from being attached to an unrelated attacker domain, so direct cross-domain cookie theft is not established. Nevertheless, this permits an attacker to make the Skill navigate its browser context to an arbitrar ...[truncated 1304 chars]- Remediation
View remediation