T05 · Unauthorized Access and Privilege Escalation
Error
- Location
tools/nba_official_report.py:21- Finding
User-Reachable Server-Side Request Forgery in Official Report URL Handling
- Content
View full analysis
\]}]+/game/[^\s)>\]}，。]+", re.IGNORECASE, ) GAME_URL_PARTS_RE = re.compile( r"/game/(?P[a-z0-9-]+)-vs-(?P[a-z0-9-]+)-(?P\d+)", re.IGNORECASE, ) def _clean_url(value: str) -> str: return str(value or "").strip().rstrip(".,，。；;!?！？)") def extract_game_url(command: str | None) -> str | None: match = GAME_URL_RE.search(command or "") return _clean_url(match.group(0)) if match else None ``` ```python url = extract_game_url(command) if url: targets = [_target_from_url(url)] scope = "single" else: targets = _targets_from_schedule( command=command, tz=tz, date_text=requested_date, team=team, opponent=opponent, scope=scope, ) reports: list[dict[str, Any]] = [] for target in targets: if target.get("url"): story = fetch_nba_game_story_url( str(target["url"]), timeout_seconds=8, ) ``` ```python def _fetch_nba_game_story_url_uncached( url: str, *, timeout_seconds: int, expected_game_id: str | None = None, away_abbr: str | None = None, home_abbr: str | None = None, ) -> dict[str, Any]: try: document = _fetch_text(url, timeout_seconds=timeout_seconds) payload = _extract_next_data(document) container = _find_story_container(payload) if not container: return unavailable_game_story("missing_story", url=url) return _story_from_container( container, url=url, payload=payload, expected_game_id=expected_game_id, away_abbr=away_abbr, home_abbr=home_abbr, ...[truncated 3154 chars]- Remediation
View remediation