T09 · Insecure Skill Coding Practices
Error
- Location
scripts/url_reader.py:431- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
list: """Extract image URLs from content.""" md_images = re.findall(r'!\[.*?\]\((https?://[^\s\)]+)\)', content) direct_images = re.findall( r'(https?://[^\s\)]+\.(?:jpg|jpeg|png|gif|webp|bmp)[^\s\)]*)', content, re.IGNORECASE ) xhs_images = re.findall(r'(https?://sns-webpic[^\s\)]+)', content) feishu_images = re.findall( r'(https?://[^\s\)]*feishu[^\s\)]+\.(?:jpg|jpeg|png|gif|webp)[^\s\)]*)', content, re.IGNORECASE ) qq_images = re.findall( r'(https?://docimg[^\s\)]+\.(?:jpg|jpeg|png|gif|webp)[^\s\)]*)', content, re.IGNORECASE ) all_images = list(dict.fromkeys( md_images + direct_images + xhs_images + feishu_images + qq_images )) return all_images def download_image(url: str, save_dir: Path, index: int) -> str: """Download an image and return its local filename.""" try: headers = { 'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) ' 'AppleWebKit/537.36', 'Referer': 'https://www.xiaohongshu.com/' } response = requests.get(url, headers=headers, timeout=30) response.raise_for_status() content_type = response.headers.get('content-type', '') if 'webp' in content_type or 'webp' in url: ext = '.webp' elif 'png' in content_type or 'png' in url: ext = '.png' elif 'gif' in content_type or 'gif' in url: ext = '.gif' else: ext = '.jpg' filename = f"img_{index:02d}{ext}" filepath ...[truncated 2538 chars]- Remediation
View remediation