T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/base.py:215- Finding
Unrestricted retrieval of API-controlled download URLs
- Content
View full analysis
bool: try: resp = requests.get(download_url, timeout=120, stream=True) resp.raise_for_status() total = int(resp.headers.get("content-length", 0)) downloaded = 0 with open(output_path, "wb") as f: for chunk in resp.iter_content(chunk_size=8192): if chunk: f.write(chunk) downloaded += len(chunk) if total > 0 and downloaded < total * 0.9: warn(f" 文件可能不完整: {downloaded}/{total} bytes") return False return True except requests.exceptions.RequestException as e: error(f" 下载失败: {e}") return False except OSError as e: error(f" 文件写入失败: {e}") return False ``` The URL passed to this method is extracted directly from remote API responses: ```python dl = res.get("downloadUrl") or res.get("url") if dl and rtype == "video" and not result["download_url"]: result["download_url"] = dl ``` The Kuaishou adapter can also use a URL from the work-list response without invoking the parsing endpoint: ```python "directVideoUrl": work.get("videoUrl") or "", ``` ### Technical Analysis The downloader treats URLs returned by `yige.zone` as trusted. It does not validate: - The URL scheme. - The destination hostname. - The resolved IP address. - Redirect destinations. - Whether the destination is loopback, private, link-local, reserved, or a cloud metadata service. - The response content type. - The maximum ...[truncated 1926 chars]- Remediation
View remediation