T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/downloader.py:154- Finding
Arbitrary URLs Are Disclosed to a Third-Party API Without YouTube Domain Validation
- Content
View full analysis
- Remediation
View remediation
` format. 7. Reject malformed URLs, nonstandard ports, fragments, and unexpected hostnames before making the API request. 8. Avoid logging the complete URL when it may contain sensitive query parameters; redact query values where practical. 9. Clearly disclose in the documentation that accepted video URLs are sent to the RedFox third-party service. Example validation approach: ```python from urllib.parse import urlsplit ALLOWED_HOSTS = { "youtube.com", "www.youtube.com", "m.youtube.com", "youtu.be", } def validate_youtube_url(value): parsed = urlsplit(value) if parsed.scheme != "https": raise ValueError("Only HTTPS YouTube URLs are allowed") hostname = (parsed.hostname or "").lower().rstrip(".") if hostname not in ALLOWED_HOSTS: raise ValueError("The URL must use an approved YouTube hostname") if parsed.username is not None or parsed.password is not None: raise ValueError("URLs containing embedded credentials are not allowed") if parsed.port not in (None, 443): raise ValueError("Nonstandard ports are not allowed") return parsed.geturl() ``` Apply this validation before displaying the URL or calling `session.post`. ]]>