T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch.mjs:62- Finding
Opt-in web research can issue requests to private or internal network destinations
- Content
View full analysis
= 300 && status < 400 && location) { return { status, headers: res.headers, body: "", redirectTo: new URL(location, url).toString() }; } const body = await res.text(); return { status, headers: res.headers, body }; } async function fetchFollowing(url, maxHops = 3) { let current = url; for (let hop = 0; hop <= maxHops; hop++) { const r = await rawGet(current); if (!r.redirectTo) return { ...r, finalUrl: current }; current = r.redirectTo; // Each hop is a fresh request, so it observes the same pacing. await sleep(intervalMs); } throw new Error(`too many redirects starting at ...[truncated 3938 chars]- Remediation
View remediation