other
Warning
- Location
- xhs_controller.py:1505
- Finding
- Undeclared Network-Capable Video Download Functionality<![CDATA[ ## Vulnerability Details **File Location**: `xhs_controller.py:1505-1531` and `xhs_controller.py:1599-1614` **Vulnerability Type**: Undeclared network-capable functionality **Risk Level**: Medium ### Vulnerable Code ```python def download_note_video(url: str, output_dir: str = "/tmp/xhs_video") -> dict: """Use yt-dlp to download a Xiaohongshu note video.""" import os, glob, json as _json result = {"success": False, "video_path": None, "title": None, "error": None} try: os.makedirs(output_dir, exist_ok=True) ytdlp = "/opt/homebrew/bin/yt-dlp" if not os.path.exists(ytdlp): import shutil ytdlp = shutil.which("yt-dlp") or "yt-dlp" cmd = [ytdlp, "-o", f"{output_dir}/%(id)s.%(ext)s", "--write-info-json", "--no-playlist", url] r = subprocess.run(cmd, capture_output=True, text=True, timeout=120) for ext in ("mp4", "mov", "webm", "flv", "m4v"): files = glob.glob(f"{output_dir}/*.{ext}") if files: result["video_path"] = files[-1] break json_files = glob.glob(f"{output_dir}/*.info.json") if json_files: with open(json_files[-1]) as f: info = _json.load(f) result["title"] = info.get("title", "") result["success"] = result["video_path"] is not None if not result["success"]: result["error"] = r.stderr[-500:] if r.stderr else "Video file not found" except Exception as e: result["error"] = str(e) return result ``` ```python def extract_current_note_video(output_dir: str = "/tmp/xhs_video") -> dict: """Extract the current note video by obtaining its URL, downloading it, and extracting frames.""" result = {"url": "", "success": False, "video_path": None, "frames": [], "video_info": {}, "error": None} try: url = get_note_url() result["url"] = url if not url: ...[truncated 2750 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the video-download and extraction functions if they are not part of the declared Skill functionality. 2. If downloading is intended, document the network behavior and expose it only through a distinct, user-consented tool. 3. Accept only `https` URLs and validate the normalized hostname against an explicit allowlist of expected RedNote domains. 4. Reject redirects to non-allowlisted hosts where technically possible. 5. Use a private directory created with `tempfile.TemporaryDirectory()` rather than a shared, predictable `/tmp` path. 6. Apply file-size, download-time, media-duration, and disk-usage limits. 7. Run media parsers with reduced privileges or sandboxing when processing remotely supplied files. 8. Return clear network and file-system effects to the user before initiating the download. ]]>