T09 · Insecure Skill Coding Practices
Error
- Location
scripts/senseaudio_video_gen.py:1165- Finding
Arbitrary URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
str: headers_map = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X) AppleWebKit/537.36 SenseAudioVideoGen/1.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", } last_error: Exception | None = None for attempt in range(3): req = urllib.request.Request(url, headers=headers_map) try: with urllib.request.urlopen(req, timeout=timeout) as resp: raw = resp.read() charset = resp.headers.get_content_charset() or "utf-8" return raw.decode(charset, errors="replace") except (urllib.error.URLError, TimeoutError, OSError) as exc: last_error = exc if attempt < 2: time.sleep(0.6 * (attempt + 1)) curl = shutil.which("curl") if curl: try: result = subprocess.run( [ curl, "-L", "--silent", "--show-error", "--max-time", str(max(5, int(timeout))), "-A", headers_map["User-Agent"], url, ], text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=True, ) if result.stdout.strip(): return result.stdout except (subprocess.CalledProcessError, OSError) as exc: last_error = exc raise SenseAudioError(f"fetch_url_text failed after retries: {last_error} ...[truncated 2639 chars]- Remediation
View remediation