T09 · Insecure Skill Coding Practices
Error
- Location
scripts/enrich_xiaoyuzhou.py:89- Finding
Unrestricted URL Enrichment Enables Server-Side Request Forgery
- Content
View full analysis
Dict[str, Any]: request = Request( url, headers={ "User-Agent": USER_AGENT, "Accept": "text/html,application/xhtml+xml", "Accept-Encoding": "gzip", "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8", }, ) with urlopen(request, timeout=30) as response: content_encoding = (response.getheader("Content-Encoding") or "").lower() decompressor = zlib.decompressobj(16 + zlib.MAX_WBITS) if "gzip" in content_encoding else None chunks: List[bytes] = [] total_read = 0 while total_read < MAX_READ_BYTES: raw_chunk = response.read(READ_CHUNK_SIZE) if not raw_chunk: break total_read += len(raw_chunk) chunk = decompressor.decompress(raw_chunk) if decompressor else raw_chunk if chunk: chunks.append(chunk) payload = extract_next_data_from_html_bytes(b"".join(chunks)) if payload is not None: return payload raise ValueError("Could not find __NEXT_DATA__ within the read limit.") ``` ```python def extract_urls_from_payload(payload: Any) -> List[str]: if isinstance(payload, list): items = payload elif isinstance(payload, dict): items = payload.get("items", []) else: return [] urls: List[str] = [] for item in items: if isinstance(item, str): urls.append(item) conti ...[truncated 4497 chars]- Remediation
View remediation
` - `/podcast/` 6. Resolve the hostname and reject any result in loopback, private, link-local, multicast, unspecified, or reserved IP ranges for both IPv4 and IPv6. 7. Disable automatic redirects or implement a redirect handler that validates every destination with the same policy before following it. 8. Apply identical validation to direct command-line URLs and URLs extracted from JSON. 9. Prefer accepting Xiaoyuzhou episode or podcast identifiers rather than complete URLs, then construct canonical URLs internally. 10. Add automated tests covering localhost, RFC1918 ranges, IPv6 loopback, alternate schemes, embedded credentials, malicious ports, DNS rebinding scenarios, and redirects to internal addresses. ]]>