T09 · Insecure Skill Coding Practices
Error
- Location
scripts/aoment_hd_repair.py:42- Finding
Unrestricted URL Fetching Enables SSRF and External Data Relay
- Content
View full analysis
tuple[str, bytes, str]: if source.startswith("http"): response = requests.get(source, timeout=60) response.raise_for_status() content_type = response.headers.get("content-type") or "image/png" return "input.png", response.content, content_type if os.path.exists(source): with open(source, "rb") as file: content = file.read() content_type = mimetypes.guess_type(source)[0] or "image/png" return os.path.basename(source) or "input.png", content, content_type try: content = base64.b64decode(source) except Exception as exc: raise ValueError(f"--image must be a local path, URL, or base64 image: {exc}") from exc return "input.png", content, "image/png" def repair_image(api_base: str, args: argparse.Namespace) -> dict: url = f"{api_base}/api/skills/aoment-image-video/hd-repair" filename, image_bytes, content_type = _read_image_source(args.image) data = { "resolution": args.resolution, "model": args.model, } files = { "file": (filename, image_bytes, content_type), } response = requests.post( url, data=data, files=files, headers=_auth_headers(args.api_key), timeout=REQUEST_TIMEOUT, ) ``` ### Technical Analysis The HD-repair script treats any value beginning with `http` as a remotely retrievable image. It performs a request without validating: - The URL scheme beyond a loose prefix check. - The destination hostname or resolved IP address. - Whether the destination is loopback, private, link-local, or otherwise reserved. - Redirect destinations. - The response size. - ...[truncated 2168 chars]- Remediation
View remediation