T09 · Insecure Skill Coding Practices
Error
- Location
scripts/read_article.sh:7- Finding
Unrestricted URL Access and Arbitrary-Path File Overwrite
- Content
View full analysis
200 || h > 200)) { urls.push(dataSrc.split('#')[0]); } ``` ```bash curl -s -o "$OUTPUT_DIR/images/$filename" "$url" || true ``` The script also writes predictable files beneath the caller-controlled directory: ```bash " 2>&1 | tail -1 > "$OUTPUT_DIR/article.json" ``` ```bash " 2>&1 | tail -1 > "$OUTPUT_DIR/image_urls.txt" ``` ### Technical Analysis The script accepts an article URL directly from its first argument and passes it to `agent-browser` without parsing the URL or enforcing the documented `mp.weixin.qq.com` host restriction. Consequently, any HTTP or HTTPS destination accepted by the browser can be accessed. The page subsequently controls the image URLs extracted from `data-src` attributes. Validation only checks that a value begins with `http` and that its displayed dimensions exceed a threshold. It does not enforce the documented `mmbiz.qpic.cn` image host, require HTTPS, restrict ports, validate DNS results, block private address ranges, or control redirects. A malicious page can therefore supply image URLs that cause `curl` to send requests to loopback, link-local, private-network, or otherwise unintended services. The output directory is also supplied directly by the caller. The script creates directories and overwrites predictable files such as `article.json`, `image_urls.txt`, and `images/img-01.jpg` without checking whether the destination is trusted, already exists, or traverses symbolic links. An attacker able to control invocation arguments can replace files at a ...[truncated 2423 chars]- Remediation
View remediation