T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wechat_mp_reader.py:107- Finding
Unrestricted article URL fetching enables server-side request forgery
- Content
View full analysis
str: resp = requests.get(url, headers={"User-Agent": USER_AGENT}, timeout=timeout) resp.raise_for_status() resp.encoding = resp.apparent_encoding or resp.encoding return resp.text ``` The same URL can subsequently be opened by Playwright: ```python def fetch_article_via_playwright(url: str, timeout: int = 20000) -> dict[str, Any]: if sync_playwright is None: raise RuntimeError("playwright not available") page = None browser = None with sync_playwright() as p: browser = p.webkit.launch(headless=True) try: page = browser.new_page( user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15", viewport={"width": 1440, "height": 2200}, ) page.goto(url, wait_until="domcontentloaded", timeout=timeout) ``` The CLI accepts the URL without validating its destination: ```python p_article.add_argument("url", help="WeChat article URL") ``` ### Technical Analysis The Skill describes the input as a WeChat article URL, but it does not enforce that requirement. There is no validation of: - URL scheme - Normalized hostname - Destination port - Embedded credentials - IP literals - DNS resolution results - Redirect destinations - Loopback, private, link-local, or reserved address ranges Consequently, an attacker who controls the article argument can cause the host running the Skill to issue requests to arbitrary network destinations. The initial request uses `requests.get()`, which follows redirects by default. If the returned page is ...[truncated 1683 chars]- Remediation
View remediation