T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lanhu-client.mjs:33- Finding
Lanhu Session Cookie Is Forwarded to Unvalidated Resource Hosts
- Content
View full analysis
controller.abort(), HTTP_TIMEOUT); try { const response = await fetch(url, { ...options, signal: controller.signal, headers: { ...HEADERS, Cookie: getCookie(), ...options.headers }, redirect: "follow", }); if (response.status === 401 || response.status === 403) { throw new Error( `认证失败 (HTTP ${response.status})。LANHU_COOKIE 可能已过期，请重新获取。`, ); } if (!response.ok) { throw new Error(`HTTP ${response.status} ${response.statusText}`); } return response; } finally { clearTimeout(timeout); } } ``` An API-provided URL is passed directly to the authenticated request function: ```js const sketchData = await requestJson(latestVersion.json_url); ``` The same issue exists in the shared file downloader: ```js export async function downloadFile(url, localPath, referer) { await mkdir(path.dirname(localPath), { recursive: true }); const headers = {}; if (referer) headers.Referer = referer; const controller = new AbortController(); const timeout = setTimeout(() => controller.abort(), HTTP_TIMEOUT); try { const response = await fetch(url, { headers: { ...HEADERS, Cookie: getCookie(), ...headers }, signal: controller.signal, redirect: "follow", }); if (!response.ok) { throw new Error(`HTTP ${response.status} ${response.statusText}`); } const buffer = Buffer.from(await response.arrayBuffer()); await writeFile(localPath, buffer); } finally { clearTimeout(timeout); } } ``` ### Technical Analysis `LANH ...[truncated 1962 chars]- Remediation
View remediation