T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_article.py:210- Finding
Server-Side Request Forgery Through Article-Controlled Resource URLs
- Content
View full analysis
bytes: hdrs = dict(headers or {}) hdrs["User-Agent"] = USER_AGENT hdrs["Referer"] = "https://mp.weixin.qq.com/" for attempt in range(2): try: req = urllib.request.Request(url, headers=hdrs) with urllib.request.urlopen(req, timeout=timeout) as resp: data = resp.read() return data[:2 * 1024 * 1024] except Exception: if attempt == 0: time.sleep(0.5) return b"" ``` ### Technical Analysis The initial article URL is validated as belonging to `mp.weixin.qq.com`, but that restriction is not applied to resource URLs extracted from the downloaded article. Stylesheets, images, and CSS background URLs are resolved and submitted to `_parallel_download()`, which ultimately calls `urllib.request.urlopen()`. There is no validation of: - The resource URL scheme. - The destination hostname. - Resolved IPv4 or IPv6 addresses. - Loopback, private, link-local, reserved, or cloud metadata address ranges. - Redirect destinations. - Whether the destination belon ...[truncated 2128 chars]- Remediation
View remediation