T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/export-feed-single-pages.mjs:174- Finding
Unrestricted Outbound Requests Enable Server-Side Request Forgery
- Content
View full analysis
&2 exit 1 fi ``` ```js const buildPageUrl = (baseUrl, page) => { const url = new URL(baseUrl); url.searchParams.set('limit', String(batchSize)); url.searchParams.set('page', String(page)); return url.toString(); }; const curlJson = (url) => { const stdout = execFileSync( 'curl', [ '--http1.1', '--compressed', '--silent', '--show-error', '--location', '--max-time', String(CURL_TIMEOUT_SECONDS), '--user-agent', 'Mozilla/5.0 Claude Export Script', '--header', 'accept: application/json,text/plain,*/*', url, ], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }, ); return JSON.parse(stdout); }; ``` ```js const normalizeUrl = (value = '', baseUrl = 'https://mp.weixin.qq.com/') => { const trimmed = String(value || '').trim(); if (!trimmed) return ''; if (trimmed.startsWith('data:')) return trimmed; try { const url = new URL(trimmed, baseUrl); if (!['http:', 'https:'].includes(url.protocol)) { return ''; } return url.toString(); } catch { return ''; } }; ``` ```js const downloadBinary = async (url) => { const response = await fetch(url, { headers: { 'user-agent': 'Mozilla/5.0 Claude Export Script', accept: 'image/*,*/*;q=0.8', referer: 'https://mp.weixin.qq.com/', }, signal: AbortSignal.timeout(IMAGE_TIMEOUT_MS), }); if (!response.ok) { throw new Error(`Image fetch failed: ${response.status} ${response.statusText}`); } const arrayBuffer = await response.arrayBuffer(); return { buffer: Buffer.from(arrayBuffer) ...[truncated 2381 chars]- Remediation
View remediation