T09 · Insecure Skill Coding Practices
Error
- Location
importers/url.py:17- Finding
Unrestricted URL Fetching Enables SSRF and Local Resource Access
- Content
View full analysis
Optional[str]: """Try fetching via openclaw CLI's web_fetch.""" try: result = subprocess.run( ["openclaw", "web-fetch", url], capture_output=True, text=True, timeout=30, ) if result.returncode == 0 and result.stdout.strip(): return result.stdout.strip() except (FileNotFoundError, subprocess.TimeoutExpired): pass return None def _fetch_via_curl(url: str) -> Optional[str]: """Fetch raw HTML via curl.""" try: result = subprocess.run( ["curl", "-sL", "--max-time", "20", "-A", "Mozilla/5.0 (compatible; DeckCraft/6.0)", url], capture_output=True, text=True, timeout=25, ) if result.returncode == 0 and result.stdout.strip(): return result.stdout.strip() except (FileNotFoundError, subprocess.TimeoutExpired): pass return None ``` ### Technical Analysis The URL import command accepts an arbitrary user-controlled string and forwards it directly to `opencl ...[truncated 2585 chars]- Remediation
View remediation