T09 · Insecure Skill Coding Practices
Error
- Location
tools/event_analyze.py:43- Finding
Unrestricted URL Fetching Enables SSRF and Local File Disclosure
- Content
View full analysis
3000 else text except Exception as e: return f"[无法提取URL内容: {e}]" ``` The URL is supplied directly through a command-line argument: ```python event_text = args.event or '' if args.url: print(f"📥 提取URL内容: {args.url}", file=sys.stderr) url_content = extract_text_from_url(args.url) if event_text: event_text = event_text + '\n\n原文摘要:\n' + url_content else: event_text = url_content if not event_text: print("ERROR: 请提供 --event 或 --url 参数", file=sys.stderr) sys.exit(1) ``` Retrieved content is also used to construct an external news query: ```python news_data = None if not args.skip_news: print("📰 获取事件相关新闻...", file=sys.stderr) search_terms = event_text[:50] news_data = run_tool('news_fetch.py', ['--query', search_terms, '--limit', '8']) ``` ### Technical Analysis The `--url` value is passed directly to `urllib.request.urlopen()` without validating its scheme, hostname, resolved IP address, port, or redirect destination. Consequently, the fetcher is not limited to public HTTPS news pages ...[truncated 2604 chars]- Remediation
View remediation