T09 · Insecure Skill Coding Practices
Error
- Location
scripts/decode.py:20- Finding
Unrestricted URL Fetching Enables SSRF and Resource Exhaustion
- Content
View full analysis
bool: return s.startswith("http://") or s.startswith("https://") def download_image(url: str) -> str: """Download an image into a temporary file and return its path.""" import urllib.request suffix = Path(url.split("?")[0]).suffix or ".png" tmp = tempfile.NamedTemporaryFile(delete=False, suffix=suffix) try: urllib.request.urlretrieve(url, tmp.name) except Exception as e: tmp.close() os.unlink(tmp.name) raise RuntimeError(f"Image download failed: {e}") tmp.close() return tmp.name ``` Python batch decoder: ```python def _is_url(s: str) -> bool: return s.startswith("http://") or s.startswith("https://") def _try_zxing(source: str) -> str | None: try: import zxingcpp from PIL import Image except ImportError: return None tmp_path = None try: if _is_url(source): import urllib.request suffix = Path(source.split("?")[0]).suffix or ".png" tmp = tempfile.NamedTemporaryFile(delete=False, suffix=suffix) urllib.request.urlretrieve(source, tmp.name) tmp.close() tmp_path = tmp.name img_path = tmp_path ``` Node.js single-image decoder: ```javascript function isUrl(s) { return s.startsWith("http://") || s.startsWith("https://"); } function downloadToTemp(url) { return new Promise((resolve, reject) => { const ext = path.extname(url.split("?")[0]) || ".png"; const tmp = path.join(os.tmpdir(), `qr_${Date.now()}${ext}`); const mod = url.startsWith("https") ? https : http; const file = fs. ...[truncated 3890 chars]- Remediation
View remediation