T09 · Insecure Skill Coding Practices
Error
- Location
reslib/cli.py:539- Finding
Unrestricted Remote Document Retrieval Enables Server-Side Request Forgery and Resource Exhaustion
- Content
View full analysis
bool: """Check if a string is a URL.""" try: result = urlparse(s) return result.scheme in ("http", "https", "ftp") except Exception: return False ``` ```python if is_url(path): source_url = path # Download the file if not quiet and not json_output: echo_info(f"Downloading from {path}...") try: import urllib.request import tempfile # Create temp file with appropriate extension parsed = urlparse(path) ext = Path(parsed.path).suffix or ".bin" with tempfile.NamedTemporaryFile(suffix=ext, delete=False) as tmp: urllib.request.urlretrieve(path, tmp.name) file_path = Path(tmp.name) except Exception as e: echo_error(f"Failed to download: {e}") ctx.exit(1) ``` ### Technical Analysis The `add` command retrieves a user-supplied URL without validating its destination. The implementation accepts HTTP, HTTPS, and FTP URLs, but does not: - Reject loopback, link-local, private, multicast, or reserved IP addresses. - Block cloud instance metadata endpoints. - Validate DNS resolutions before connecting. - Revalidate destinations after HTTP redirects. - Apply explicit connection or read timeouts. - Impose a maximum response or downloaded-file size. - Restrict remote retrieval to approved domains. Consequently, a caller can direct the process to request services that are reachable from the machine running the CLI but are not reachable from the caller's own network position. Redirects and DNS rebinding may also bypass checks if only the original URL is validated in a future partial fix. Because the downloaded response is subsequently hashed, copied into the attac ...[truncated 2009 chars]- Remediation
View remediation