T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/zhihu_publish.js:50- Finding
Unrestricted Browser Navigation to a User-Controlled URL
- Content
View full analysis
- Remediation
View remediation
`. 5. Reject embedded credentials, non-default ports, malformed URLs, IP-address hosts, and URL fragments if they are unnecessary. 6. Monitor navigation and reject redirects to destinations outside the allowlist. 7. Resolve destination addresses and reject loopback, private, link-local, multicast, and reserved address ranges where practical. 8. Perform validation again after redirects because validating only the initial URL does not prevent an allowed host from redirecting to an unsafe destination. Example hardening logic: ```javascript function validateQuestionUrl(value) { const url = new URL(value); if (url.protocol !== 'https:') { throw new Error('Only HTTPS URLs are allowed'); } if (url.hostname !== 'www.zhihu.com') { throw new Error('Only www.zhihu.com URLs are allowed'); } if (url.port) { throw new Error('Custom ports are not allowed'); } if (!/^\/question\/\d+\/?$/.test(url.pathname)) { throw new Error('Invalid Zhihu question URL'); } return url.toString(); } const validatedUrl = validateQuestionUrl(questionUrl); await page.goto(validatedUrl, { waitUntil: 'networkidle', timeout: 30000 }); ``` ]]>