T09 · Insecure Skill Coding Practices
Error
- Location
main.go:63- Finding
Server-Side Request Forgery Through Insufficient URL and Redirect Validation
- Content
View full analysis
1 { cleaned := cleanURL(match[1]) if cleaned != "" && !seen[cleaned] { seen[cleaned] = true urls = append(urls, cleaned) } } } ``` ```go resp, err := client.Do(req) ``` ### Technical Analysis The application attempts to restrict input to LinkedIn by checking whether the raw argument contains the substring `linkedin.com`. This is not a valid origin check. An arbitrary URL can satisfy the condition by placing that text in its path, query string, user-information component, or attacker-controlled hostname. For example, `http://127.0.0.1:8080/?linkedin.com` passes the check while directing the HTTP request to localhost. The page-fetching client also follows redirects without validating the destination. Consequently, even a genuinely permitted origin could redirect the client to a private or otherwise prohibited address. The extracted media URL is also insufficiently constrained. In particular, the JSON-LD `contentUrl` pattern accepts any HTTP or HTTPS origin. `cleanURL` only checks whether Go can parse the value; it does not enforce an approved hostname, scheme policy beyond the regular expression, or destination IP policy. The resulting URL is subsequently req ...[truncated 1549 chars]- Remediation
View remediation