T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pipeline.py:276- Finding
Unrestricted URLs Enable Authenticated SSRF and Arbitrary Data Egress
- Content
View full analysis
int: """Send to webhook.""" url = destination.get("url") if not url: raise ValueError("Webhook destination requires 'url' parameter") headers = {"Content-Type": "application/json"} if destination.get("auth") == "bearer": headers["Authorization"] = f"Bearer {destination.get('token')}" req = urllib.request.Request( url, data=json.dumps(data).encode('utf-8'), headers=headers, method='POST' ) response = urllib.request.urlopen(req, timeout=30) return len(data) ``` ### Technical Analysis The REST source and webhook destination accept arbitrary configuration-controlled URLs. The implementation does not validate the URL scheme, destination hostname, resolved IP address, port, redirect target, or transport security. An attacker who can create or modify a pipeline configuration can make the process contact loopback, private-network, link-local, or cloud metadata endpoints. Because `urllib.request.urlopen` follows HTTP redirects under normal operation, v ...[truncated 1949 chars]- Remediation
View remediation