T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:45
- Finding
- Unchecked User-Controlled URL Retrieval May Enable Server-Side Request Forgery<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:45` and `references/details.md:357-369` **Vulnerability Type**: Unrestricted remote resource retrieval / Server-Side Request Forgery (SSRF) **Risk Level**: Medium ### Vulnerable Code `SKILL.md:45`: ```markdown - 提供API/URL → 先获取数据再分析 ``` English meaning: when an API or URL is provided, fetch the data before analyzing it. `references/details.md:357-369`: ```python def load_data(path): """数据加载""" if path.endswith('.csv'): try: return pd.read_csv(path) except: return pd.read_csv(path, encoding='gbk') elif path.endswith('.xlsx'): return pd.read_excel(path) elif path.endswith('.json'): return pd.read_json(path) else: raise ValueError(f"不支持的文件格式: {path}") ``` ### Technical Analysis The skill explicitly instructs the Agent to fetch user-provided API endpoints or URLs. Its reference implementation passes the supplied `path` directly to pandas data readers without validating: - The URL scheme - The destination hostname or resolved IP address - Whether the address belongs to a loopback, link-local, private, or reserved network - Redirect destinations - Response size or download duration - Whether remote access is necessary and authorized Pandas readers can retrieve remote resources through their underlying URL and filesystem handlers. Consequently, an attacker may provide a URL ending in a supported suffix such as `.csv`, `.xlsx`, or `.json` and cause an Agent with network access to send a request to an otherwise inaccessible service. The extension check does not provide a security boundary. A URL path, query arrangement, redirecting endpoint, or attacker-controlled server can satisfy the suffix check while directing the request toward another destination. The broad `except:` block also obscures the original failure and may trigger a second request to the same target. This package contains documentation rather than ...[truncated 1634 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Disable arbitrary remote ingestion by default** - Prefer uploaded files or explicitly approved local paths. - Require clear user confirmation before contacting any remote endpoint. 2. **Restrict URL schemes** - Permit only `https`. - Explicitly reject `file:`, `ftp:`, `gopher:`, `data:`, and other unsupported or dangerous schemes. 3. **Apply destination controls** - Use an allowlist of approved domains where feasible. - Resolve the hostname before connecting and reject loopback, private, link-local, multicast, unspecified, and reserved IP ranges for both IPv4 and IPv6. - Repeat destination validation after every DNS resolution and redirect to mitigate DNS rebinding and redirect-based bypasses. 4. **Use a hardened download layer** - Do not pass untrusted URLs directly to pandas. - Download through a dedicated HTTP client with strict connection and read timeouts, response-size limits, redirect limits, TLS verification, and content-type checks. - Save the validated response to a securely created temporary file and then give that local file to pandas. 5. **Constrain data handling** - Enforce the documented file-size limits before loading content into memory. - Reject authentication-bearing URLs and avoid forwarding ambient credentials, cookies, or internal authorization headers. - Run data processing in a network-restricted sandbox. 6. **Improve exception handling** - Replace the broad `except:` clause with specific exceptions such as decoding and parser errors. - Avoid automatically issuing a second request until the failure has been classified. - Ensure errors returned to users do not expose sensitive internal response data. ]]>