T09 · Insecure Skill Coding Practices
Warning
- Location
hunter.py:60- Finding
Arbitrary URL Fetch Enables Server-Side Request Forgery
- Content
View full analysis
Dict: """檢查 API 提供者頁面""" result = { 'url': url, 'has_pricing': False, 'has_free_tier': False, 'has_signup': False, 'api_key_location': None, 'direct_link': None } try: resp = self.session.get(url, timeout=10) text = resp.text.lower() # 檢查關鍵詞 if 'pricing' in text or 'price' in text: result['has_pricing'] = True if 'free' in text and ('tier' in text or 'plan' in text): result['has_free_tier'] = True if 'sign up' in text or 'register' in text or 'get api key' in text: result['has_signup'] = True # 找直接連結 if 'get started' in text or 'try free' in text: result['direct_link'] = url except Exception as e: result['error'] = str(e) return result ``` ### Technical Analysis The public `check_api_dashboard()` method accepts a caller-controlled URL and passes it directly to `requests.Session.get()` without validating the URL scheme, destination hostname, resolved IP address, or network range. Redirects are followed by default, and redirected destinations are not revalidated. Consequently, a caller able to invoke this method can cause the host running the Skill to issue HTTP GET requests to loopback interfaces, private network addresses, link-local services, or cloud metadata endpoints. A public URL that redirects to an internal address could also bypass superficial validation added only to the initial URL. The response body is not returned directly, but it is inspected for several keywords. The resulting flags, exceptions, response timing, and request side effects can still provide an attacker with an interna ...[truncated 1371 chars]- Remediation
View remediation