T09 · Insecure Skill Coding Practices
Warning
- Location
when_common.py:44- Finding
Unrestricted HTTP Target Selection Enables SSRF-Style Network Access
- Content
View full analysis
dict: req = request.Request(url=url, method="GET") with request.urlopen(req, timeout=timeout) as resp: data = resp.read().decode("utf-8") payload = json.loads(data) if not isinstance(payload, dict): raise ValueError("GET response is not a JSON object") return payload def _http_json_post(url: str, body: dict, timeout: float) -> dict: req = request.Request( url=url, method="POST", data=json.dumps(body, ensure_ascii=False).encode("utf-8"), headers={"Content-Type": "application/json"}, ) with request.urlopen(req, timeout=timeout) as resp: data = resp.read().decode("utf-8") payload = json.loads(data) if not isinstance(payload, dict): raise ValueError("POST response is not a JSON object") return payload ``` ```python def _build_base_url(config: dict) -> str: ip = str(config.get("clock_ip", "")).strip() port = config.get("clock_port", 80) if not ip: raise ValueError("Clock IP is not configured") try: port_int = int(port) except (TypeError, ValueError) as exc: raise ValueError("clock_port must be an integer") from exc if not 1 <= port_int <= 65535: raise ValueError("clock_port must be between 1 and 65535") return f"http://{ip}:{port_int}" ``` ### Technical Analysis The Skill requires LAN network access to control clock devices, so HTTP communication itself is consistent with its declared purpose. However, the configured `clock_ip` is only checked for non-emptiness. It is not verified as an IP literal, restricted to an approved private subnet, or matched against an adminis ...[truncated 2156 chars]- Remediation
View remediation