T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/audit.py:355- Finding
Optional URL Validation Permits Blind Server-Side Request Forgery
- Content
View full analysis
\]]+)", content)) return urls ``` ```python def check_urls(content): """Check that URLs in the narrative are reachable.""" findings = [] urls = extract_urls(content) for url in sorted(urls): try: req = urllib.request.Request(url, method="HEAD") req.add_header("User-Agent", "project-narrator-audit/1.0") urllib.request.urlopen(req, timeout=10) except urllib.error.HTTPError as e: if e.code >= 400: findings.append(Finding( "WARNING", "URL Check", f"URL returned HTTP {e.code}: {url}" )) except (urllib.error.URLError, OSError, ValueError): findings.append(Finding( "WARNING", "URL Check", f"URL unreachable: {url}" )) return findings ``` ```python if check_urls_flag: print("Checking URLs (this may take a moment)...") all_findings.extend(check_urls(content)) ``` ### Technical Analysis When `--check-urls` is enabled, the audit script extracts arbitrary HTTP and HTTPS URLs from the narrative and passes them directly to `urllib.request.urlopen`. It does not validate the destination hostname or resolved IP address. The implementation does not reject: - Loopback addresses such as `127.0.0.1` or `::1` - RFC1918 private network addresses - Link-local addresses such as `169.254.0.0/16` - Cloud instance metada ...[truncated 2711 chars]- Remediation
View remediation