T09 · Insecure Skill Coding Practices
Error
- Location
scripts/crawl.py:38- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery and Local Resource Access
- Content
View full analysis
2 else 5000 html = fetch_url(url) ``` The same behavior appears in `scripts/rss_fetcher.py:11-19`: ```python def fetch_rss(url, timeout=30): """获取RSS feed""" headers = { 'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36' } try: req = Request(url, headers=headers) with urlopen(req, timeout=timeout) as response: return response.read().decode('utf-8', errors='ignore') except Exception as e: return f"Error: {e}" ``` The RSS URL is taken directly from command-line input at `scripts/rss_fetcher.py:61-64`: ```python url = sys.argv[1] max_items = int(sys.argv[2]) if len(sys.argv) > 2 else 10 xml = fetch_rss(url) ``` ### Technical Analysis Both network-facing scripts pass attacker-controlled URLs directly to `urllib.request.Request` and `urlopen`. They do not validate: - The URL scheme. - The destination hostname or resolved IP address. - Whether the destination is loopback, link-local, private, reserved, or multicast. - Whether the destination is a cloud metadata endpoint. - Redirect targets. - Embedded URL credentials. - The maximum number of bytes read from the response. Although arbitrary URL retrieval is par ...[truncated 2265 chars]- Remediation
View remediation