T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate.py:160- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
bool: """Download a URL to a local file. Returns True on success.""" try: headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Accept": "image/*,*/*;q=0.8", } response = client.get(url, headers=headers, follow_redirects=True, timeout=20.0) if response.status_code == 200 and len(response.content) > 1000: content_type = response.headers.get("content-type", "") if "image" in content_type or "octet" in content_type or len(response.content) > 5000: dest.parent.mkdir(parents=True, exist_ok=True) dest.write_bytes(response.content) size_kb = len(response.content) / 1024 print(f" ✓ Downloaded: {dest.name} ({size_kb:.0f}KB)", flush=True) return True except Exception as e: print(f" ✗ Download failed: {e}", flush=True) return False ``` ```python def fetch_product_image(client: httpx.Client, product_url: str, dest: Path) -> bool: """Try to find and download the main product image from a product page.""" try: from bs4 import BeautifulSoup except ImportError: print(" ⚠ beautifulsoup4 not available for product image extraction", flush=True) return False print(" Fetching product page for main image...", flush=True) try: headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Accept": "text/html,*/*", } response = client.get(product_url, headers=headers, follow_redirects=True, timeout=20.0) if response.status_cod ...[truncated 4559 chars]- Remediation
View remediation