T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/render.sh:19- Finding
Unrestricted Card Image URL Enables Server-Side Request Forgery
- Content
View full analysis
/\>/g; s/"/\"/g; s/'"'"'/\'/g' } # Validate image URL (block dangerous protocols) validate_image_url() { local url="$1" # Block file://, javascript:, data: (except data:image), and vbscript: if [[ "$url" =~ ^(file:|javascript:|vbscript:) ]]; then echo "" return fi if [[ "$url" =~ ^data: ]] && [[ ! "$url" =~ ^data:image/ ]]; then echo "" return fi echo "$url" } ``` ```bash generate_card() { local data="$1" TITLE=$(echo "$data" | jq -r '.title // ""') SUBTITLE=$(echo "$data" | jq -r '.subtitle // ""') BODY=$(echo "$data" | jq -r '.body // ""') STATUS=$(echo "$data" | jq -r '.status // ""') IMAGE=$(echo "$data" | jq -r '.image // ""') # Escape all user-supplied text TITLE=$(escape_html "$TITLE") SUBTITLE=$(escape_html "$SUBTITLE") BODY=$(escape_html "$BODY") IMAGE_HTML="" if [[ -n "$IMAGE" && "$IMAGE" != "null" ]]; then # Validate image URL (block dangerous protocols) IMAGE=$(validate_image_url "$IMAGE") if [[ -n "$IMAGE" ]]; then IMAGE=$(escape_html "$IMAGE") IMAGE_HTML="" fi fi ``` ```html
{{IMAGE_HTML}} ``` ```bash # Render with wkhtmltoimage /usr/bin/wkhtmltoimage \ --quiet \ --width "$WIDTH" \ --enable-javascript \ --javascript-delay 500 \ --format png \ "$TEMP_DIR/render.html" \ "$OUTPUT_FILE" ``` ### Technical Analysis The c ...[truncated 3320 chars]- Remediation
View remediation