T09 · Insecure Skill Coding Practices
Error
- Location
scripts/verify_links.py:113- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
str: cmd = [ "curl", "-sI", "-o", "/dev/null", "-w", "%{http_code}", "--max-time", "10", "-L", "-A", USER_AGENT, url, ] try: out = subprocess.check_output(cmd, text=True).strip() return out or "000" except Exception: return "000" def fetch(url: str) -> tuple[str, str, str]: req = Request(url, headers={"User-Agent": USER_AGENT}) try: with urlopen(req, timeout=TIMEOUT) as resp: body = resp.read(120000).decode("utf-8", errors="ignore") return str(resp.status), resp.geturl(), body ``` `scripts/verify_links.py:221-228`: ```python def verify_url(url: str) -> LinkResult: domain = normalize_domain(url) http_status = curl_head(url) result = LinkResult(url=url, domain=domain, http_status=http_status) if http_status in {"404", "410"}: result.verdict = "dead" result.evidence = f"HTTP {http_status}" ``` `scripts/serp_gap_analyzer.py:111-136`: ```python def fetch(url: str): req = Request(url, headers={"User-Agent": USER_AGENT}) try: with urlopen(req, timeout=TIMEOUT) as resp: body = resp.read(180000).decode("utf-8", errors="ignore") return str(resp.status), resp.geturl(), body except HTTPError as e: body = e.read(180000).decode("utf-8", errors="ignore") if hasattr(e, "read") else "" return str(e.code), url, body except URLError: return "000", url, "" except Exception: return "000", url, "" def jina_fetch(url: str) -> str: """Fetch a URL via Jina Reader (r.ji ...[truncated 4128 chars]- Remediation
View remediation