T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_best_image.py:35- Finding
Unrestricted Search-Result URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
Dict[str, Any]: encoded = urllib.parse.quote(query, safe="") url = f"https://www.bing.com/images/search?q={encoded}" text = fetch(url) blocks = re.findall(r'm="({"sid":.*?})"', text) results = [] seen = set() for block in blocks: raw = html.unescape(block) img = re.search(r'"murl":"(.*?)"', raw) page = re.search(r'"purl":"(.*?)"', raw) title = re.search(r'"t":"(.*?)"', raw) if not img: continue image_url = img.group(1) if image_url in seen: continue seen.add(image_url) results.append({ "engine": "bing", "image_url": image_url, "page_url": page.group(1) if page else "", "title": html.unescape(title.group(1)) if title else "", }) ``` The selected URL is then opened directly: ```python def download(url: str, query: str): req = urllib.request.Request( url, headers={ "User-Agent": UA, "Referer": "https://www.bing.com/", }, ) with urllib.request.urlopen(req, timeout=30) as resp: data = resp.read() content_type = resp.headers.get("Content-Type") ``` Equivalent unrestricted downloads occur in: ```python # scripts/fetch_candidate_images.py def download(url: str, query: str, idx: int): req = urllib.request.Request(url, headers={"User-Agent": UA, "Referer": "https://www.bing.com/"}) with ...[truncated 3157 chars]- Remediation
View remediation