T09 · Insecure Skill Coding Practices
Warning
- Location
camara_client.py:224- Finding
Unrestricted Pagination and Redirect URLs Permit Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
str: parsed = urlsplit(url) if parsed.scheme and parsed.scheme != "https": raise CamaraAPIError("Pagination URL must use HTTPS") if parsed.hostname and parsed.hostname != ALLOWED_HOST: raise CamaraAPIError("Pagination URL uses an untrusted host") if parsed.port not in (None, 443): raise CamaraAPIError("Pagination URL uses an unexpected port") if parsed.username is not None or parsed.password is not None: raise CamaraAPIError("Pagination URL must not contain user information") path = parsed.path if parsed.hostname and not path.startswith(ALLOWED_PREFIX): raise CamaraAPIError("Pagination URL is outside the API path") return url ``` Construct the `AsyncClient` with `follow_redirects=False`, inspect redirect responses explicitly, and apply equivalent validation to each `Location` header. ]]>