T09 · Insecure Skill Coding Practices
Error
- Location
invoice_analyzer.py:328- Finding
Untrusted Email URLs Permit Server-Side Request Forgery and Arbitrary Browser Navigation
- Content
View full analysis
List[str]: """Extract all URLs.""" urls = [] standard = re.findall( r'https?://[^\s<>"{}|\\^`\[\]]+', content ) urls.extend(standard) encoded = re.findall( r'https?%3A%2F%2F[^\s<>"{}|\\^`\[\]]+', content ) from urllib.parse import unquote for url in encoded: try: urls.append(unquote(url)) except: pass hrefs = re.findall( r'href=["\'](https?://[^"\']+)["\']', content ) urls.extend(hrefs) seen = set() unique = [] for url in urls: url = url.strip().rstrip('>"\'') if url not in seen and len(url) > 20: seen.add(url) unique.append(url) return unique ``` ```python @staticmethod def is_valid_download_url(url: str) -> bool: if not url or len(url) < 15: return False url_lower = url.lower() exclude_patterns = [ 'login', 'register', 'captcha', 'verify', 'auth', 'news', 'article', 'blog', 'help', 'support', 'account', 'password', 'reset', 'signup', 'signin' ] allowed_patterns = [ 'download', 'pdf', 'invoice', 'fapiao', 'fp', 'file', 'attach', 'view', 'preview', 'open', 'nnfp', 'jss.com.cn', 'chinatax', 'dppt' ] if any(pattern in url_lower for pattern in allowed_patterns): return True for pattern in exclude_patterns: if pattern in url_lower: return False if url_lower.endswith('.pdf'): return True try: parsed = urlparse(url) if not parsed.netloc or not parsed.scheme: return False except: r ...[truncated 2698 chars]- Remediation
View remediation