T09 · Insecure Skill Coding Practices
Error
- Location
scripts/horizon.py:56- Finding
Configurable Feed URLs Permit SSRF Through DNS and IPv6 Validation Bypasses
- Content
View full analysis
bool: """Check if hostname looks like a private/internal IP address.""" parts = hostname.split(".") if len(parts) != 4: return False try: octets = [int(p) for p in parts] except ValueError: return False if octets[0] == 10: return True if octets[0] == 172 and 16 <= octets[1] <= 31: return True if octets[0] == 192 and octets[1] == 168: return True if octets[0] == 169 and octets[1] == 254: return True return False def _validate_public_url(url_str: str, label: str) -> str: """Validate that a URL is HTTPS and targets a public host (not internal/private).""" from urllib.parse import urlparse parsed = urlparse(url_str) if parsed.scheme not in ("https",): _print({"error": f"{label} must use HTTPS"}) sys.exit(1) hostname = (parsed.hostname or "").lower() if not hostname: _print({"error": f"{label} has no hostname"}) sys.exit(1) if hostname in _BLOCKED_HOSTS or _is_private_ip(hostname): _print({"error": f"{label} cannot target private/internal addresses"}) sys.exit(1) return url_str ``` The validation is applied to user-configurable feeds as follows: ```python elif cmd == "start-feed": if len(args) < 3: _print({"error": "usage: start-feed [config_json]"}) sys.exit(1) name = _validate_id(args[1], "feed_name") feed_type = _validate_id(args[2], "feed_type") if feed_type not in _VALID_FEED_TYPES: _print({"error": f ...[truncated 3820 chars]- Remediation
View remediation