T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/flomo-sync.py:267- Finding
Unrestricted Attachment Retrieval Enables SSRF and Unbounded Disk Consumption
- Content
View full analysis
str | None: """ Download an attachment into images_dir/YYYY/MM/DD/{slug}_{name}. """ ext = _ext_from_url(url) or Path(name).suffix.lower() if ext not in IMAGE_EXTS and ext not in AUDIO_EXTS: return None try: dt = datetime.strptime(created_at[:10], "%Y-%m-%d") date_path = Path(f"{dt.year:04d}") / f"{dt.month:02d}" / f"{dt.day:02d}" except (ValueError, TypeError): date_path = Path("unknown") dest_dir = images_dir / date_path dest_dir.mkdir(parents=True, exist_ok=True) safe_name = name.replace("/", "_").replace("\\", "_") if not Path(safe_name).suffix and ext: safe_name = safe_name + ext filename = f"{slug}_{safe_name}" dest_path = dest_dir / filename if dest_path.exists(): return str(Path("images") / date_path / filename) try: resp = requests.get(url, timeout=30, stream=True) resp.raise_for_status() with open(dest_path, "wb") as f: for chunk in resp.iter_content(chunk_size=65536): f.write(chunk) return str(Path("images") / date_path / filename) except Exception as e: print(f" ⚠ Download failed {name}: {e}", flush=True) return None ``` The function is invoked for attachment URLs supplied by the remote API: ```python if images_dir is not None: local_path = download_attachment(url, name, slug, created_at, images_dir) ``` ### Technical Analysis Attachment URLs are taken from the flomo API response and passed directly to `requests.get()`. The implementation does not validate: - The URL scheme - The desti ...[truncated 2516 chars]- Remediation
View remediation