T09 · Insecure Skill Coding Practices
Error
- Location
scripts/02-fetch-content.js:55- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery and Unbounded Downloads
- Content
View full analysis
{ const curl = spawn('curl', ['-sL', '--max-time', '30', url]); let data = ''; let error = ''; curl.stdout.on('data', (chunk) => { data += chunk; }); curl.stderr.on('data', (chunk) => { error += chunk; }); curl.on('close', (code) => { if (code !== 0 && !data) { reject(new Error(`curl failed: ${error}`)); } else { resolve(data); } }); curl.on('error', reject); }); } ``` The remote URL is later passed directly to this function: ```js const html = await fetchUrl(url); ``` ### Technical Analysis The URL originates from records returned by the MixDAO API and is passed directly to `curl` without validation. The implementation does not restrict the URL scheme, destination hostname, destination port, resolved IP address, or redirect destinations. The `-L` option instructs `curl` to follow redirects automatically. Even if an initial URL appears safe, it can redirect to a loopback address, private network service, link-local cloud metadata endpoint, or another prohibited destination. Depending on the protocols supported by the installed `curl` build, non-HTTP schemes such as `file:` may also be accessible. All response data is accumulated in the `data` string without a byte limit. The 30-second timeout limits request duration but does not impose a response-size limit, allowing a large or rapidly generated response to consume substantial process memory. Fetching arbitrary article URLs is necessary for the declared functionality, but unrestricted access to local files, internal networks, cloud metadata services, and arbitrary protocols exceeds the minimum pr ...[truncated 1790 chars]- Remediation
View remediation