T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/poe1_build_pipeline.py:25- Finding
Arbitrary URL Retrieval Enables Server-Side Request Forgery
- Content
View full analysis
Any: if path_or_url.startswith(("http://", "https://")): req = urllib.request.Request(path_or_url, headers={"User-Agent": "poe1-build-analyst/1.0"}) with urllib.request.urlopen(req, timeout=30) as response: return json.loads(response.read().decode("utf-8")) return json.loads(Path(path_or_url).read_text(encoding="utf-8")) ``` ### Technical Analysis The `--ninja-json` argument is passed to `load_json`, which accepts any URL beginning with `http://` or `https://`. It does not restrict the hostname to PoE Ninja or another approved public data provider. The standard URL opener also follows redirects. Consequently, validating only the initial scheme does not prevent an external server from redirecting the request to a loopback, private-network, or link-local destination. The requested response is parsed as JSON, and candidate rows extracted from it can be copied into the generated report. Although the code does not intentionally transmit local files or credentials, it grants broader network access than the Skill's declared need to retrieve public PoE build statistics. ### Attack Path 1. An attacker supplies an internal URL through `--ninja-json`, such as an HTTP service on loopback, a private network, or a link-local metadata address. 2. Alternatively, the attacker supplies a public URL that redirects to such an internal address. 3. `urllib.request.urlopen` performs the request from the environment running the Skill. 4. If the response is valid JSON in a supported structure, `rows_from_payload` extracts its records. 5. The retrieved records are included in the generated output report, potentially exposing internal response data. ### Impact Assessment Succes ...[truncated 433 chars]- Remediation
View remediation