T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/google_index.py:110- Finding
Unrestricted Recursive Sitemap Fetching Enables Server-Side Request Forgery
- Content
View full analysis
list[str]: """Fetch and parse a sitemap XML, returning all URLs. Handles both regular sitemaps and sitemap index files. """ import httpx urls: list[str] = [] try: resp = httpx.get(sitemap_url, timeout=30, follow_redirects=True) resp.raise_for_status() except Exception as e: print(f"Error fetching sitemap {sitemap_url}: {e}", file=sys.stderr) return urls try: root = ET.fromstring(resp.content) except ET.ParseError as e: print(f"Error parsing sitemap XML: {e}", file=sys.stderr) return urls # Strip namespace for easier parsing ns = "" if root.tag.startswith("{"): ns = root.tag.split("}")[0] + "}" # Check if it's a sitemap index sitemap_tags = root.findall(f"{ns}sitemap") if sitemap_tags: # It's a sitemap index — recurse into each child sitemap for sm in sitemap_tags: loc = sm.find(f"{ns}loc") if loc is not None and loc.text: child_urls = fetch_sitemap_urls(loc.text.strip()) urls.extend(child_urls) ``` The initial sitemap URL is supplied directly through the CLI without validation: ```python auto_parser.add_argument( "--sitemap", "-s", required=True, help="Sitemap URL to fetch (e.g. https://example.com/sitemap.xml)", ) ``` ### Technical Analysis The application makes HTTP requests to a caller-controlled sitemap URL and follows redirects automatically. It does not validate: - The URL scheme. - The destination hostname. - Resolved IPv4 or IPv6 addresses. - Redirect destinations. - Child sitemap URLs extracted from sitemap-index documents. - Whether child sitemaps rema ...[truncated 2399 chars]- Remediation
View remediation