T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/douyin_download.py:68- Finding
Unrestricted short-link resolution permits SSRF-style network requests
- Content
View full analysis
str: """ Follow redirects on a v.douyin.com short link and return the final URL. This is needed because short links don't embed the modal_id directly. """ try: resp = requests.head(url, allow_redirects=True, timeout=10) return resp.url except requests.RequestException as e: raise ValueError(f"Could not resolve short link '{url}': {e}") from e ``` ```python # 4. Short link — resolve then retry if "v.douyin.com" in text: resolved = resolve_short_link(text) if resolved != text: return extract_modal_id(resolved) ``` ### Technical Analysis The program treats an input as a Douyin short link whenever the unparsed string contains `v.douyin.com`. This is a substring check rather than validation of the URL's actual hostname. Consequently, an attacker can place that string in a query parameter, path, user-information component, or fragment while directing the request to another host. For example, the following input passes the check but targets a loopback service: ```text http://127.0.0.1:8080/probe?v.douyin.com ``` The call to `requests.head()` then executes using the network privileges of the host running the Skill. Moreover, `allow_redirects=True` follows redirects without checking the scheme, hostname, resolved IP address, or each destination in the redirect chain. Although the implementation does not return the response body, request errors, redirects, and timing can expose service availability. A HEAD request may also cause side effects in incorrectly implemented internal services. ### Attack Path 1. An attacker places a crafted URL in content processed as the Skill's input. 2. The URL includes the literal string `v.douyin.c ...[truncated 1219 chars]- Remediation
View remediation