T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/lib/utils.js:4- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
a.localeCompare(b)); url.search = ''; for (const [key, value] of sorted) { url.searchParams.append(key, value); } if (url.pathname.length > 1 && url.pathname.endsWith('/')) { url.pathname = url.pathname.slice(0, -1); } return url.toString(); } catch { return null; } } ``` ```js // scripts/lib/fetchers/http-fetcher.js:12-17 async function fetchOnce(url, { method = 'GET', headers = {}, body = undefined } = {}) { return fetch(url, { method, headers: buildHeaders(headers), body, redirect: 'manual', }); } ``` ```js // scripts/lib/fetchers/http-fetcher.js:19-58 export async function fetchWithRedirects(inputUrl, options = {}) { const redirectChain = []; let currentUrl = normalizeUrl(inputUrl); let redirects = 0; const method = options.method || 'GET'; const startedAt = Date.now(); if (!currentUrl) { throw new Error(`Invalid URL: ${inputUrl}`); } while (redirects <= (options.maxRedirects || MAX_REDIRECTS)) { const response = await fetchOnce(currentUrl, options); const headers = Object.fromEntries(response.headers.entries()); const locat ...[truncated 4711 chars]- Remediation
View remediation