T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cache_doc.py:129- Finding
Redirect Validation Bypass and Unbounded Documentation Download
- Content
View full analysis
str: req = urllib.request.Request(url, headers={'User-Agent': USER_AGENT}) with urllib.request.urlopen(req, timeout=20) as resp: charset = resp.headers.get_content_charset() or 'utf-8' return resp.read().decode(charset, errors='replace') ``` ### Technical Analysis The submitted URL is initially restricted by `validate_url()` to HTTPS URLs hosted on `esphome.io` or `www.esphome.io`. However, `urllib.request.urlopen()` follows HTTP redirects automatically, and `fetch_html()` does not validate the final response URL or each intermediate redirect target. A redirect from an allowed ESPHome URL can therefore bypass the intended hostname, scheme, port, direct-IP, user-information, and query-string restrictions. The function may retrieve content from a destination that would have been rejected if supplied directly. The response is also read into memory without a maximum byte limit and without validating its content type. A permitted endpoint or redirected destination could return a very large or non-HTML response, resulting in excessive memory consumption. The downloaded content is subsequently converted to text and written into the persistent local documentation cache, which can also consume disk space and introduce untrusted content into a cache intended to contain official ESPHome documentation. The request only includes the configured user-agent and does not intentionally transmit local files, credentials, environment variables, or workspace content. Therefore, the pre-scan network behavior is necessary for documentation retrieval, but redirect handling causes it to exceed the intended official-domain network boundary. ### Attack Path 1. A user or Agent invokes `cache ...[truncated 1778 chars]- Remediation
View remediation