T09 · Insecure Skill Coding Practices
Error
- Location
scripts/search-strategy.sh:167- Finding
Unrestricted URL Handling Enables Local File Disclosure and Server-Side Request Forgery
- Content
View full analysis
/dev/null | head -100 || { log_warn "直接存取失敗，嘗試 jina.ai 代理..." curl -s --compressed "https://r.jina.ai/http://$(echo "$URL" | sed -e 's|https://||' -e 's|http://||')" | head -200 } fi ``` ### Technical Analysis The script checks only whether `URL` is nonempty. It does not restrict the URL scheme, validate the destination host, resolve and inspect destination IP addresses, or prevent access to local and private resources. Quoting `"$URL"` prevents shell word splitting and shell metacharacter expansion, but it does not enforce a safe URL policy. Curl supports schemes other than HTTP and HTTPS, including `file://`. Consequently, a caller can cause the process to read files accessible to the operating-system account running the Skill. HTTP destinations are also unrestricted. The process can therefore send requests to loopback interfaces, private networks, link-local addresses, and potentially cloud instance metadata services. This constitutes server-side request forgery when an untrusted party can influence the URL passed to the Skill. Additionally, curl is not given an explicit `--` option terminator. A URL-like input beginning with `-` may be interpreted as a curl command-line option rather than a URL. ### Attack Path #### Local File Disclosure 1. An attacker influences a URL handled by the Agent or directly invokes the Skill with a crafted URL. 2. The attacker explicitly selects the `multi` engine, bypassing the d ...[truncated 1702 chars]- Remediation
View remediation