T09 · Insecure Skill Coding Practices
Warning
- Location
airport_manager.py:229- Finding
Arbitrary Airport Update URL Enables Server-Side Request Forgery
- Content
View full analysis
bool: """Download airport data from *url* and merge into existing data. - Empty URL → return False - Validates downloaded data structure - Merges: keeps existing entries, adds new entries, fills missing fields - Writes via atomic replace - Rebuilds indices on success - Any failure → logs warning, returns False, existing data untouched """ if not url: return False try: resp = requests.get(url, timeout=30) resp.raise_for_status() new_data = resp.json() except Exception as e: logger.warning("Failed to download airport data from %s: %s", url, e) return False ``` The URL is sourced directly from a command-line argument or configuration: ```python def cmd_update_airports(args): """Handle 'update-airports' subcommand: manually update airport data.""" conf = cfg.get_config() cache_cfg = conf["cache"] # URL priority: CLI --url > config.yaml > AIRPORT_UPDATE_URL constant url = getattr(args, "url", None) or cache_cfg.get("airport_update_url", "") or cfg.AIRPORT_UPDATE_URL if not url: print("Error: no update URL provided. Use --url or set airport_update_url in config.yaml", file=sys.stderr) sys.exit(1) print(f"Updating airport data from: {url}") ok = airport_manager.update_from_url(url) ``` Configured URLs may also be requested automatically: ```python def _auto_update_airports(): """Check and auto-update airport data at startup (silent on failure).""" try: conf = cfg.get_config() cache_cfg = conf["cache"] update_days = cache_cfg.get("airport_update_days", 30) ...[truncated 2876 chars]- Remediation
View remediation