T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_china.py:115- Finding
Weak URL Validation Allows Internal-Network Browsing Through Camofox
- Content
View full analysis
Optional[str]: """Auto-detect platform from URL.""" for platform, pattern in PLATFORM_PATTERNS.items(): if re.search(pattern, url, re.IGNORECASE): return platform return None ``` The individual parsers repeat the same validation pattern and then forward the original URL to Camofox: ```python def can_handle(self, url: str) -> bool: return bool(re.search(r'weibo\.(com|cn)', url, re.IGNORECASE)) def fetch(self, url: str, port: int = 9377) -> Dict[str, Any]: session_key = f"weibo-{int(time.time())}" snapshot = camofox_fetch_page(url, session_key, wait=8, port=port) ``` Equivalent substring checks and Camofox fetches are present for Bilibili and CSDN. ### Technical Analysis The platform-validation logic searches the complete user-supplied URL for a recognizable domain substring. It does not parse the URL and verify that the actual destination hostname belongs to the intended platform. Consequently, an unrelated or internal destination can pass validation merely by including a trusted platform name elsewhere in the URL, such as in the path, query string, or user-information component. For example: ```text http://127.0.0.1:8080/?target=weibo.com http://192.168.1.1/csdn.net http://169.254.169.254/latest/meta-data/?bilibili.com ``` After the substring check succeeds, the unmodified URL is passed to `camofox_fetch_page()`. Camofox o ...[truncated 1593 chars]- Remediation
View remediation