T09 · Insecure Skill Coding Practices
Error
- Location
scripts/extract_weekly.js:128- Finding
Unrestricted URL Navigation in a Chromium Process with the Sandbox Disabled
- Content
View full analysis
l.trim()) .filter(l => l.startsWith('http')); if (links.length === 0) { console.error('链接文件为空或格式不正确'); process.exit(1); } console.log(`发现 ${links.length} 个链接`); ``` ```javascript const userDataDir = path.join(os.homedir(), '.smarttable-check-browser'); console.log('\n启动浏览器...'); browser = await puppeteer.launch({ headless: false, defaultViewport: null, userDataDir, args: ['--no-sandbox', '--disable-blink-features=AutomationControlled'] }); ``` ```javascript const page1 = await browser.newPage(); await page1.goto(links[0], { waitUntil: 'domcontentloaded', timeout: 30000 }); ``` ```javascript const page = await browser.newPage(); await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 30000 }); await sleep(3000); ``` ### Technical Analysis The links file is treated as externally supplied input, but the only validation performed is a string-prefix check for `http`. The code does not parse the URL, require HTTPS, constrain the destination to an approved WeChat domain, reject unexpected ports, or prevent navigation to loopback and private-network addresses. Every accepted URL is subsequently opened through `page.goto()`. Consequently, an attacker who can modify or provide the links file can cause the browser to access arbitrary attacker-controlled or internal-network resources. The Chromium process is also launched with `--no-sandbox`. Disabling the browser sandbox removes an important isolation boundary intended to limit the impact of a compromised renderer. A successful Chromium exploit delivered by an attacker-controlled page could therefore have a substantially greater effect than it would unde ...[truncated 1900 chars]- Remediation
View remediation