T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/v2_check_executor.py:8- Finding
Unauthenticated Remote Task Bundles Execute Arbitrary Python Evaluators
- Content
View full analysis
tuple[Path, dict]: session = config.get("task_session") or {} session_id = session.get("session_id") ticket = session.get("ticket") if not session_id or not ticket: raise RuntimeError("missing v2 task session credentials for remote bundle download") params = urllib.parse.urlencode( { "lang": config.get("lang", "zh"), "session_id": session_id, "version": bundle_version, } ) request = urllib.request.Request( f"{config['api_base'].rstrip('/')}/api/v2/bundle?{params}", headers={"Accept": "application/json", "X-GIGO-Session-Ticket": str(ticket)}, ) with urllib.request.urlopen(request, timeout=30) as response: archive = json.loads(response.read().decode("utf-8")) if str(archive.get("bundle_version")) != bundle_version: raise RuntimeError("remote v2 bundle version does not match the active session") if bundle_hash and str(archive.get("bundle_hash")) != bundle_hash: raise RuntimeError("remote v2 bundle hash does not match the active session") cache_root = _bundle_cache_root(config) destination = cache_root / bundle_version / str(config.get("lang", "zh")) remote_manifest = { "bundle_version": bundle_version, "bundle_hash": archive.get("bundle_hash", bundle_hash), "bundle_channel": archive.get("bundle_channel", session.get("bundle_channel", "stable")), "tasks": [], } return materialize_archive(archive, destination), remote_manifest ``` The downloaded bundle's evaluator is subsequently imported and executed: `` ...[truncated 2341 chars]- Remediation
View remediation