T09 · Insecure Skill Coding Practices
Warning
- Location
- references/lark-im-messages-send.md:40
- Finding
- Unrestricted Remote Markdown Image Retrieval<` by downloading and uploading them first 3. Normalizes the Markdown for Feishu post rendering 4. Wraps the result as: ```json {"zh_cn":{"content":[[{"tag":"md","text":"..."}]]}} ``` This means `--markdown` is convenient, but it is not a full-fidelity Markdown transport. ### Current Markdown Caveats - It does **not** promise full CommonMark / GitHub Flavored Markdown support. - It always becomes a `post` payload with a single `zh_cn` locale. - It does **not** let you set a `post` title. If you need a title, use `--msg-type post --content ...`. - Headings are rewritten: - `# Title` becomes `#### Title` - `##` to `######` are normalized to `#####` when the content contains H1-H3 - Consecutive headings are separated with blank lines after heading normalization. - Block spacing and line breaks may be normalized during conversion. - Code blocks are preserved as code blocks. - Excess blank lines are compressed. - Only `http://...`, `https://...`, or already-uploaded `img_xxx` Markdown images are kept reliably. - Local paths in Markdown image syntax like `` are **not** auto-uploaded by `--markdown`; they may be stripped during optimization. - If remote Markdown image download/upload fails, that image is removed with a warning. ``` The reply workflow documents the same behavior: ```markdown 2. Resolves remote Markdown images like `` ``` and: ```markdown - Only remote `http:/ ...[truncated 2929 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Disable automatic remote-image retrieval by default. 2. Require explicit confirmation that identifies every remote URL before downloading and uploading it. 3. Prefer requiring users to download and inspect remote media separately before attaching it. 4. Permit only HTTPS unless an explicitly approved exception is required. 5. Resolve hostnames before connection and reject loopback, private, link-local, multicast, unspecified, and reserved addresses for both IPv4 and IPv6. 6. Repeat destination validation after every redirect and DNS resolution. 7. Block known cloud metadata destinations and metadata hostnames. 8. Set strict connection, read, total-duration, redirect-count, response-size, and decompressed-size limits. 9. Validate the response MIME type and file signature against an allowlist of supported image formats. 10. Do not forward ambient credentials, cookies, proxy authorization, or Lark tokens to remote image servers. 11. Log the original URL, final resolved destination, response size, and upload destination without recording credentials or sensitive response content. 12. Add equivalent controls to both `+messages-send` and `+messages-reply`. ]]>