T09 · Insecure Skill Coding Practices
Error
- Location
scripts/extract_colors.py:11- Finding
Unvalidated Website Fetch Enables Server-Side Request Forgery and Unbounded Response Consumption
- Content
View full analysis
") sys.exit(1) url = sys.argv[1] if not url.startswith('http'): url = 'https://' + url print(f"Extracting colors from {url}...\n") colors, rgb_colors = extract_colors(url) ``` ### Technical Analysis The script accepts an arbitrary URL and passes it directly to `urllib.request.urlopen`. It does not strictly validate the URL scheme, resolve and inspect the destination address, reject private or reserved networks, or validate the destination again after an HTTP redirect. Consequently, an attacker who can control the script argument can cause requests to loopback addresses, link-local services, private network hosts, or other endpoints reachable from the execution environment. Public endpoints that redirect to internal addresses can also bypass checks because redirect targets are not inspected. The call to `response.read()` reads the complete response into memory. The 15-second timeout limits waiting time but does not impose a maximum response size. A remote server can therefore return an excessively large or continuously streamed response and cause significant memory consumption. ### Attack Path 1. An attacker supplies a URL such as an internal HTTP service, loopback endpoint, o ...[truncated 1256 chars]- Remediation
View remediation