T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/classroom_note_translator.py:116- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
str: resp = requests.get(page_url, headers=DEFAULT_HTTP_HEADERS, timeout=30) if resp.status_code >= 400: raise RuntimeError(f"Failed to fetch page {page_url}: {resp.status_code}") ``` ```python def download_media_file(media_url: str, temp_dir: Path) -> Tuple[Path, bool]: resp = requests.get(media_url, headers=DEFAULT_HTTP_HEADERS, stream=True, timeout=180) if resp.status_code >= 400: raise RuntimeError(f"Failed to download media {media_url}: {resp.status_code}") content_type = resp.headers.get("Content-Type", "") ext = extension_from_url(media_url) or content_type_to_extension(content_type) if not ext: ext = ".mp4" if infer_is_video(media_url, content_type) else ".mp3" file_path = temp_dir / f"page_media{ext}" with file_path.open("wb") as f: for chunk in resp.iter_content(chunk_size=1024 * 1024): if chunk: f.write(chunk) return file_path, infer_is_video(str(file_path), content_type) ``` ```python temp_dir_obj = tempfile.TemporaryDirectory(prefix="classroom_note_translator_page_") temp_dir = Path(temp_dir_obj.name) media_url = extract_media_url_from_page(page_url) media_path, is_video = download_media_file(media_url, temp_dir) return media_path, is_video, temp_dir_obj, media_url ``` ### Technical Analysis The `--page-url` value is fetched directly without validating its scheme, hostname, resolved IP address, or destination network. The script then parses attacker-controlled HTML and issues a second request to the selected media URL. Neither request restricts redirects or prevents access to loopback, link-local, private, reserved, or cloud metadata addresses. Consequently, the scri ...[truncated 1896 chars]- Remediation
View remediation