T09 · Insecure Skill Coding Practices
Error
- Location
lib/torchsdk/tokens.js:272- Finding
Unrestricted On-Chain Metadata URL Fetch Enables Server-Side Request Forgery
- Content
View full analysis
{ const controller = new AbortController(); const timer = setTimeout(() => controller.abort(), timeoutMs); const opts = { ...options, signal: controller.signal }; try { // If it's an Irys gateway URL, use uploader directly (gateway has SSL issues) if ((0, exports.isIrysUrl)(url)) { const uploaderUrl = (0, exports.irysToUploader)(url); return await fetch(uploaderUrl, opts); } // For non-Irys URLs, fetch normally return await fetch(url, opts); ``` ### Technical Analysis The metadata URI is decoded from a token's on-chain bonding-curve account. A token creator can therefore control this value. Although the gateway helper specially handles Irys URLs, every other URI is passed directly to `fetch()`. The implementation does not: - Restrict the scheme to HTTPS. - Restrict requests to approved metadata gateways. - Reject loopback, link-local, private, multicast, or reserved IP ranges. - Resolve and validate DNS addresses before connecting. - Validate redirect destinations. - Restrict response size or verify that the response is JSON. The monitor invokes `getToken()` for discovered tokens with active loans. Consequently, this request can occur automatically during normal unattended operation rather than only in ...[truncated 1987 chars]- Remediation
View remediation