T09 · Insecure Skill Coding Practices
Error
- Location
bin/content-watcher.js:115- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
') .description('Add a source to monitor') .option('-n, --name ', 'Source name') .option('-t, --type ', 'Source type (rss|url)', 'rss') .action(async (url, options) => { const config = await loadConfig(); const source = { id: Date.now().toString(), url, name: options.name || url, type: options.type, addedAt: new Date().toISOString() }; ``` `bin/content-watcher.js:115-130` ```js const allArticles = []; for (const source of config.sources) { try { console.log(chalk.gray(`Fetching: ${source.name}`)); const articles = await rss.parse(source.url, config.maxItemsPerSource); for (const article of articles) { if (!options.all && config.seenUrls.includes(article.link)) { continue; } try { const content = await fetcher.extract(article.link); const summary = await summarizer.summarize(content || article.contentSnippet || ''); allArticles.push({ ``` `lib/rss.js:12-25` ```js async parse(url, limit = 10) { try { const feed = await this.parser.parseURL(url); return (feed.items || []).slice(0, limit).map(item => ({ title: item.title || 'Untitled', link: item.link || item.guid || '', contentSnippet: item.contentSnippet || item.content || '', pubDate: item.pubDate || item.isoDate || new Date().toISOString(), author: item.author || item.creator || 'Unknown' })); } catch (error) { throw new Error(`RSS parse failed: ${error.message}`); } } ``` `lib/fetch.j ...[truncated 3045 chars]- Remediation
View remediation