T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/fetch_news.py:43
- Finding
- Untrusted RSS Content Can Manipulate Agent Output## Vulnerability Details **File Location**: `scripts/fetch_news.py`, lines 43-78, 101, and 144-153 **Vulnerability Type**: Untrusted external content handling and plaintext transport **Risk Level**: Medium ### Vulnerable Code ```python with urllib.request.urlopen(req, timeout=10) as response: content = response.read().decode('utf-8', errors='ignore') # Simple RSS parsing items = content.split('<item>') for item in items[1:]: # Skip header title = '' link = '' description = '' # Extract title if '<title>' in item and '</title>' in item: start = item.find('<title>') + 7 end = item.find('</title>') title = item[start:end].strip() # Remove CDATA if present title = title.replace('<![CDATA[', '').replace(']]>', '') # Extract link if '<link>' in item and '</link>' in item: start = item.find('<link>') + 6 end = item.find('</link>') link = item[start:end].strip() # Extract description if '<description>' in item and '</description>' in item: start = item.find('<description>') + 13 end = item.find('</description>') description = item[start:end].strip() # Remove HTML tags and CDATA description = description.replace('<![CDATA[', '').replace(']]>', '') # Simple tag removal import re description = re.sub(r'<[^>]+>', '', description) if len(description) > 150: description = description[:150] + '...' ``` ```python feeds = [ ('https://feeds.bbci.co.uk/news/rss.xml', 'BBC'), ('http://www.xinhuanet.com/english/news_english.xml', '新华网'), ('https://rss.nytimes.com/services/xml/rss/nyt/World.xml', 'NYTimes'), ] ``` ```python for i, item in enumerate(news_items, 1): emoji = ['1️⃣', '2️⃣', '3️⃣', '4️⃣', '5️⃣'][i-1] lines.append(f"{emoji} {item['title']}") lines.append(f" 来源：{item['source']}") if item['description'] and item['description'] != '暂无摘要': lines ...[truncated 2301 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the plaintext RSS URL with a verified HTTPS endpoint. Reject any configured URL that does not use HTTPS. 2. Validate redirects explicitly and reject redirects to plaintext schemes or unexpected hosts. 3. Maintain an allowlist of exact feed hostnames and validate the final response URL after redirects. 4. Parse feeds with a maintained XML or RSS parser rather than delimiter-based string operations. 5. Treat every title, description, and link as untrusted data. Present these values in a clearly delimited or quoted data structure and instruct the consuming Agent never to follow instructions found in feed content. 6. Normalize control characters and apply reasonable field-length limits before output. 7. Validate extracted links and permit only expected `https` URLs if links are later exposed or opened. 8. Consider using source authentication, signed content where available, or a trusted news aggregation API when output integrity is important. 9. Log fetch and validation failures without including unsafe feed content, rather than silently suppressing every exception.