T09 · Insecure Skill Coding Practices
Error
- Location
scripts/scraper.py:278- Finding
Unrestricted URL Navigation in a Browser with the Security Sandbox Disabled
- Content
View full analysis
VideoData: if sync_playwright is None: print("⚠️ Playwright 未安装", file=sys.stderr) return VideoData(url=url) with sync_playwright() as p: browser, page = self._launch_browser(p) try: print(f"🎬 分析视频: {url}", file=sys.stderr) page.goto(url, wait_until="domcontentloaded", timeout=30000) video = self._extract_video_detail(page, url) print(f"✅ 分析完成", file=sys.stderr) return video except Exception as e: print(f"⚠️ 分析出错: {e}", file=sys.stderr) return VideoData(url=url) finally: browser.close() ``` ```python analyze_p.add_argument("--url", required=True, help="视频链接") ``` ### Technical Analysis The `analyze` command accepts an arbitrary URL and passes it directly to Playwright's `page.goto()` without validating its scheme, hostname, resolved address, port, or redirect destination. Although the command is described as analyzing a Douyin video, the implementation does not restrict navigation to Douyin domains. An attacker can therefore instruct the agent to analyze URLs targeting loopback addresses, private networks, link-local services, or other endpoints reachable from the host. Redirects from an initially acceptable-looking URL are also not validated. The browser is additionally launched with both `--no-sandbox` and `--disable-setuid-sandbox ...[truncated 2129 chars]- Remediation
View remediation