T09 · Insecure Skill Coding Practices
Error
- Location
scripts/seo_audit.py:183- Finding
Sitemap-Driven Server-Side Request Forgery Across Audit Scripts
- Content
View full analysis
list[str]: """Parse sitemap.xml and return all URLs. Handles sitemap index files.""" resp = safe_fetch(sitemap_url) if not resp or resp.status_code != 200: return [] content = resp.text urls = [] # Check if it's a sitemap index if "\s*(.*?)\s*', content) for sub_url in sub_sitemaps: sub_resp = safe_fetch(sub_url) if sub_resp and sub_resp.status_code == 200: urls.extend(re.findall(r'\s*(.*?)\s*', sub_resp.text)) else: urls = re.findall(r'\s*(.*?)\s*', content) return urls ``` The corresponding fetch implementation at `scripts/seo_audit.py:52-59` is: ```python def fetch(url: str, *, follow_redirects: bool = True) -> requests.Response: """Fetch a URL with standard headers.""" return requests.get( url, headers={"User-Agent": USER_AGENT, "Accept-Encoding": "gzip, br"}, timeout=REQUEST_TIMEOUT, allow_redirects=follow_redirects, ) ``` `scripts/geo_audit.py:67-84`: ```python def fetch(url: str) -> requests.Response: return requests.get( url, headers={"User-Agent": USER_AGENT, "Accept-Encoding": "gzip, br"}, timeout=REQUEST_TIMEOUT, allow_redirects=True, ) def safe_fetch(url: str) -> requests.Response | None: try: return fetch(url) except Exception as exc: print(f" ⚠️ Failed to fetch {url}: {exc}", file=sys.stderr) return None ``` `scripts/perf_audit.py:54 ...[truncated 3560 chars]- Remediation
View remediation