T09 · Insecure Skill Coding Practices
Error
- Location
scripts/download.py:29- Finding
Unvalidated Third-Party Download URL Enables Server-Side Request Forgery and Unsafe Public File Publication
- Content
View full analysis
str: headers = {'User-Agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15'} resp = requests.get(download_url, stream=True, timeout=60, headers=headers, allow_redirects=True) resp.raise_for_status() with open(output_path, 'wb') as f: for chunk in resp.iter_content(chunk_size=65536): if chunk: f.write(chunk) return output_path def process(video_url: str) -> dict: os.makedirs(VIDEO_DIR, exist_ok=True) result = get_no_watermark_url(video_url) if result.get('code') not in (200, 0): return {'success': False, 'error': result.get('msg', '解析失败')} dl_url = extract_download_url(result) if not dl_url: return {'success': False, 'error': f'未找到下载链接，API返回: {result}'} filename = f'video_{int(time.time())}.mp4' output_path = os.path.join(VIDEO_DIR, filename) download_video(dl_url, output_path) size = os.path.getsize(output_path) public_url = f'{BASE_URL}/{filename}' return {'success': True, 'path': output_path, 'size': size, 'public_url': public_url} ``` ### Technical Analysis The download URL is taken from a third-party API response and passed directly to `requests.get`. The implementation only checks whether the returned string starts with `http`; it does not validate the scheme precisely, destination hostname, resolved IP address, port, redirect targets, content type, file signature, or response size. Because `allow_redirects=True` is enabled, even an initially acceptable URL could redirect to a loopback, link-local, private-network, reserved, or cloud metadata address. The downloaded response is then sa ...[truncated 1851 chars]- Remediation
View remediation