T09 · Insecure Skill Coding Practices
- Location
references/code-examples/image_utils.py:82- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
Vulnerability Details
File Location:
references/code-examples/image_utils.py, lines 82-107
Vulnerability Type: Server-Side Request Forgery through unrestricted image URL loading
Risk Level: MediumVulnerable Code
python # URL if source.startswith(("http://", "https://")): return ImageUtils.load_from_url(source) # File path return Image.open(source) raise ValueError(f"Unsupported source type: {type(source)}") @staticmethod def load_from_url(url: str, timeout: int = 30) -> Image.Image: """ Download and load image from URL. Args: url: Image URL timeout: Request timeout in seconds Returns: PIL Image object """ response = requests.get( url, timeout=timeout, headers={"User-Agent": "BriaSkills/1.3.4"} ) response.raise_for_status() return Image.open(io.BytesIO(response.content))Technical Analysis
The
load()method treats any string beginning withhttp://orhttps://as a remotely retrievable image. The value is passed torequests.get()without validating the destination hostname or resolved IP address.The implementation does not reject loopback, private, link-local, multicast, or reserved network ranges. It also does not constrain redirects, so a permitted-looking URL could redirect to an internal destination. Although remote image loading is part of the declared functionality, access to arbitrary internal network locations is not required to download public images and therefore exceeds minimum necessary network privileges.
The response is subsequently passed to Pillow and must normally represent a supported image for the method to return successfully. This limits direct response disclosure but does not prevent the outbound request itself. Timing, status-depend ...[truncated 1346 chars]
- Remediation
View remediation
Remediation Suggestions
- Permit HTTPS only unless plaintext HTTP is explicitly required.
- Parse URLs with a standards-compliant parser and allow only expected schemes.
- Resolve the hostname before connecting and reject loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 addresses.
- Disable automatic redirects or validate the hostname and resolved address again for every redirect.
- Where practical, use an explicit allowlist of trusted image hosts.
- Route outbound downloads through a restricted proxy with network-level egress controls.
- Apply a maximum response size and stream the body rather than loading an unlimited response into memory.
- Validate the response content type and verify image data before further processing.
- Use separate connection and read timeouts and impose a maximum redirect count.