T09 · Insecure Skill Coding Practices
Error
- Location
skills/project-generate/scripts/modules/script_generator.py:46- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
str: """Read web page content.""" try: from urllib.request import urlopen, Request req = Request(url, headers={"User-Agent": "Mozilla/5.0"}) with urlopen(req, timeout=15) as resp: html = resp.read().decode("utf-8", errors="replace") text = re.sub(r"<[^>]+>", "", html) text = re.sub(r"\s+", " ", text).strip() return text[:5000] except Exception as e: return f"[URL read error: {e}]" ``` The comments, docstring, and error message above have been translated into English for report readability; the executable control flow is unchanged. ### Technical Analysis The script accepts any string beginning with `http://` or `https://` and passes it directly to `urllib.request.urlopen`. There is no validation of the destination hostname or resolved IP address. The implementation does not reject: - Loopback destinations such as `127.0.0.1` or `[::1]` - RFC 1918 private networks - Link-local networks - Cloud instance metadata services such as `169.254.169.254` - Reserved or otherwise non-public address ranges - Redirects from an initially public URL to an internal destination The 15-second timeout and 5,000-character output truncation limit resource consumption but do not prevent access to internal services. The fetched response is returned to the script-generation workflow, creating a potential channel for extracting internal HTTP response content. This behavior exceeds the minimum privilege needed to retrieve public articles because the feature requires public web ...[truncated 1398 chars]- Remediation
View remediation