T09 · Insecure Skill Coding Practices
Warning
- Location
light.py:72- Finding
Unrestricted User-Controlled Network Destination Enables SSRF-Like Requests
- Content
View full analysis
dict: """ Real HTTP GET to Hue Bridge. 真实的 HTTP 请求调用 Hue Bridge。 """ # NOTE: Requires actual Hue username in production / 生产环境需填写真实 token url = f"http://{self.ip}/api/s2-agent-user/lights/1" try: req = urllib.request.Request(url) with urllib.request.urlopen(req, timeout=3.0) as response: data = json.loads(response.read().decode('utf-8')) if isinstance(data, dict) and "state" in data: return data return {"error": "Hue auth missing or light not found", "state": {"on": False}} except Exception as e: return {"error": str(e), "state": {"on": False}} def fetch_wiz_state(self) -> dict: """ Real UDP socket call to Wiz Bulb. 真实的 UDP Socket 直连调用 Wiz 灯泡。 """ try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(3.0) msg = b'{"method":"getPilot","params":{}}' sock.sendto(msg, (self.ip, 38899)) data, _ = sock.recvfrom(1024) return json.loads(data.decode('utf-8')) except Exception as e: return {"error": f"Connection failed: {str(e)}", "result": {"state": False}} ``` The destination originates from command-line input: ```python parser.add_argument("--ip", help="Device IP / 设备 IP") parser.add_argument("--zone", help="Spatial Zone / 空间区域") parser.add_argument("--grid", help="2x2 Grid Coordinates / 2x2 网格坐标") parser.add_argument("--protocol", choices=["hue", "wiz", "mqtt"], default="hue") ``` It is then passed directly to the network adapter: ```python adapter = S2VoxelLight(args.ip, args.zone, args.grid) raw_state = {} if args.protocol == "hue": raw_state = ...[truncated 3148 chars]- Remediation
View remediation