T09 · Insecure Skill Coding Practices
Error
- Location
lib/fetcher.js:138- Finding
Server-Side Request Forgery Through Unrestricted URL Fetching
- Content
View full analysis
{ const url = new URL(urlStr); const protocol = url.protocol === 'https:' ? https : http; const options = { hostname: url.hostname, path: url.pathname + url.search, headers: { 'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36' }, timeout: 30000 }; protocol.get(options, (res) => { if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) { return httpGet(res.headers.location).then(resolve).catch(reject); } let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => resolve(data)); }).on('error', reject).setTimeout(options.timeout, () => { reject(new Error('请求超时')); }); }); } ``` The untrusted URL originates from command-line input in both add workflows: ```js // scripts/shoucang-add.js:32-41 const url = process.argv[2]; if (!url) { console.log('用法: node shoucang-add.js '); process.exit(1); } console.log(`开始抓取: ${url}`); try { // 1. 抓取网页 const fetchResult = await fetcher.fetch(url); ``` ```js // scripts/smart-collect.js:69-74 if (args[0] === 'add' && args[1]) { const url = args[1]; console.log(`抓取: ${url}`); try { const fetchResult = await fetcher.fetch(url); ``` ### Technical Analysis The application sends requests to a user-controlled URL without validating the destination hostname, resolved IP address, port, or redirect target. An attacker able to invoke either add workflow can therefore make the process request HTTP services available from the host's network context. There are no controls preventing access to: - Loopback addresses such as `127.0.0.1` ...[truncated 2697 chars]- Remediation
View remediation