T09 · Insecure Skill Coding Practices
Error
- Location
scripts/crawler.py:48- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
str: """获取页面内容""" self._apply_delay() headers = kwargs.pop('headers', self.headers) proxy = self._get_proxy() for attempt in range(self.max_retries): try: response = self.session.get( url, headers=headers, proxies=proxy, timeout=self.timeout, **kwargs ) response.raise_for_status() response.encoding = response.apparent_encoding return response.text except requests.RequestException as e: if attempt == self.max_retries - 1: raise Exception(f"请求失败: {url}, 错误: {e}") time.sleep(2 ** attempt) # 指数退避 return "" ``` #### `scripts/crawler.py:132-157` ```python def download(self, url: str, save_path: str, **kwargs) -> str: """下载文件""" self._apply_delay() proxy = self._get_proxy() response = self.session.get( url, headers=self.headers, proxies=proxy, timeout=self.timeout, stream=True, **kwargs ) response.raise_for_status() with open(save_path, 'wb') as f: for chunk in response.iter_content(chunk_size=8192): f.write(chunk) return save_path ``` #### `scripts/crawler_engine.py:61-77` ```python def _crawl_static(self, url: str, extract_rules: Dict[str, str]) -> Dict: """静态爬取（使用 requests）""" try: response = self.session.get(url, timeout=30) response.raise_for_status() ...[truncated 5396 chars]- Remediation
View remediation