T09 · Insecure Skill Coding Practices
- Location
scripts/help_read.py:48- Finding
Arbitrary URL Fetch Enables Server-Side Request Forgery
- Content
View full analysis
Vulnerability Details
File Location:
scripts/help_read.py:48-63
Vulnerability Type: Arbitrary outbound request / SSRF
Risk Level: HighVulnerable Code
python url = args.url host = _url_host(url) # Ensure .md suffix if not url.endswith(".md"): # Only the two Help Center hosts serve raw Markdown at '<url>.md' if host in _DOC_HOSTS: url = url.rstrip("/") + ".md" site = (getattr(args, "site", None) or "").strip().lower() if site in SITES and host and host != SITES[site]["result_host"]: print(f"WARN[site-cross]: --site {site} points at {SITES[site]['result_host']} but the given URL is " f"on '{host}'; the URL is read as-is and no cross-site rewriting is performed", file=sys.stderr) text = fetch(url, max_bytes=DOC_MAX_BYTES)The request is ultimately executed by the shared transport layer:
python req = urllib.request.Request(url, headers={"User-Agent": UA}) opener = urllib.request.urlopen if allow_redirects else _NO_REDIRECT_OPENER.open try: with opener(req, timeout=effective_timeout(timeout or TIMEOUT)) as resp: data = resp.read()Technical Analysis
The
readcommand accepts a user-controlled URL and derives its host with_url_host(). However, membership in_DOC_HOSTSis used only to determine whether the.mdsuffix should be appended. An unapproved host is never rejected.A site mismatch also produces only a warning and explicitly continues to read the URL as supplied. Consequently, arbitrary URL schemes and destinations accepted by
urllib.requestcan reach the network transport.Redirects are enabled by default in
fetch(). Therefore, even if direct input were later restricted to an approved Alibaba Cloud host, a redirect could still send the request to an unapproved destination unless every redirect target is validated.This behavior contradicts the module statement that only Help Center hosts are accepted and exceeds the minimum network access r ...[truncated 1478 chars]
- Remediation
View remediation
Remediation Suggestions
-
Enforce an exact destination allowlist before every request:
- Require the
httpsscheme. - Permit only
help.aliyun.comandwww.alibabacloud.com. - Reject missing hosts, user-information components, nonstandard schemes, and unexpected ports.
- Require the
-
Do not merely warn on a host mismatch. Return an input error before making a request.
-
Disable automatic redirects for document reads. If redirects are required, process them manually and validate every destination against the same scheme, host, and port policy.
-
Resolve the destination and reject loopback, private, link-local, multicast, reserved, and unspecified IP addresses. Repeat validation after each redirect and account for multiple DNS answers.
-
Consider constraining paths to the documented Help Center layouts rather than allowing every path on an approved domain.
-
Add regression tests covering:
- Direct requests to localhost and private IP addresses.
- Link-local metadata addresses.
- Unsupported schemes such as
file:. - Approved hosts redirecting to unapproved hosts.
- Hostname parsing edge cases, embedded credentials, and unexpected ports.
- Valid China and international Help Center document URLs.
A suitable validation flow is:
python parsed = urllib.parse.urlsplit(url) if parsed.scheme != "https": raise _UsageError("Only HTTPS Help Center URLs are supported.") if parsed.hostname not in _DOC_HOSTS: raise _UsageError("Only official Alibaba Cloud Help Center hosts are supported.") if parsed.username or parsed.password or parsed.port not in (None, 443): raise _UsageError("URL credentials and nonstandard ports are not supported.") text = fetch(url, max_bytes=DOC_MAX_BYTES, allow_redirects=False)If legitimate canonical redirects must be supported, follow them through a bounded loop and apply the full validation policy to each
Locationvalue before issuing the next request.-