T09 · Insecure Skill Coding Practices
Error
- Location
run_daily_digest.py:62- Finding
Unrestricted Feed and Article Fetching Enables Server-Side Request Forgery
- Content
View full analysis
str: req = urllib.request.Request(url, headers={"User-Agent": USER_AGENT}) def _read_with_context(context: ssl.SSLContext) -> str: with urllib.request.urlopen(req, timeout=timeout, context=context) as resp: return resp.read().decode("utf-8", errors="ignore") try: return _read_with_context(ssl.create_default_context()) except ssl.SSLCertVerificationError: if not allow_insecure_fallback: raise return _read_with_context(ssl._create_unverified_context()) except urllib.error.URLError as ex: if not allow_insecure_fallback: raise if isinstance(ex.reason, ssl.SSLCertVerificationError): return _read_with_context(ssl._create_unverified_context()) raise ``` The configured RSS URL is passed directly to this unrestricted function: ```python for src in sources: name = src.get("name", "unknown") rss = src.get("rss_url", "").strip() category = src.get("category", "其他") if not rss: errors.append(f"{name}: rss_url empty") continue try: xml_text = fetch_text(rss, allow_insecure_fallback=allow_insecure_fallback) entries = parse_rss(xml_text)[:per_source] ``` Article URLs obtained from feed entries are also fetched directly: ```python def fetch_article_excerpt(url: str, allow_insecure_fallback: bool = False) -> str: if not url: return "" # Avoid non-HTML pages such as PDF downloads. if url.lower().endswith(".pdf"): return "" try: page = fetch_text(url, timeout=12, allow_insecure_fallback=allow_insecure_fallback) except Exc ...[truncated 3234 chars]- Remediation
View remediation