T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/render_iciba_card.py:157- Finding
Unrestricted outbound URL fetching enables server-side request forgery
- Content
View full analysis
dict: req = Request(url, headers={"User-Agent": "Mozilla/5.0"}) with urlopen(req, timeout=timeout) as response: return json.loads(response.read().decode("utf-8")) ``` ```python def load_data(args: argparse.Namespace) -> dict: data = dict(FALLBACK_DATA) if args.input_json: input_path = Path(args.input_json) live = json.loads(input_path.read_text(encoding="utf-8")) data.update({k: v for k, v in live.items() if v not in (None, "")}) data["_data_source"] = f"input_json:{input_path.name}" return data try: live = fetch_json(args.api_url) if not isinstance(live, dict): raise ValueError("api did not return a JSON object") data.update({k: v for k, v in live.items() if v not in (None, "")}) data["_data_source"] = "live_api" except Exception as exc: data["_data_source"] = f"fallback_data:{exc.__class__.__name__}" return data ``` ```python def picture_candidates(data: dict) -> list[tuple[str, str]]: candidates: list[tuple[str, str]] = [] for key in ("picture", "picture2", "picture3", "picture4"): value = data.get(key) if isinstance(value, str) and value.startswith("http") and all(value != url for _, url in candidates): candidates.append((key, value)) return candidates def download_image_to_png(url: str, path: Path, timeout: int = 30) -> bool: req = Request(url, headers={"User-Agent": "Mozilla/5.0"}) try: with urlopen(req, timeout=timeout) as response: raw = response.read() image = Image.open(BytesIO(raw)). ...[truncated 3065 chars]- Remediation
View remediation