T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/workflow.py:309- Finding
Magnet URI Parameter Injection Through Unencoded Release Titles
- Content
View full analysis
str: return f"magnet:?xt=urn:btih:{infohash}&dn={name}" ``` ### Technical Analysis The release name is inserted directly into the `dn` parameter of a magnet URI without percent-encoding. This name originates from the title field of a remote Nyaa RSS response and therefore crosses an external trust boundary. If a release title contains magnet URI delimiters such as `&`, the resulting value can escape the intended `dn` parameter and introduce additional parameters. For example, a title containing `&tr=https://attacker.example/announce` can add an attacker-controlled tracker to the generated magnet URI. The parser applies HTML entity decoding to RSS titles, so a title represented as `&tr=...` in valid XML may become `&tr=...` before reaching `_magnet()`. The associated `infohash` is also accepted without format validation. Although the fixed `xt=urn:btih:` prefix limits the direct effect of that field, validating it would strengthen the same URI-construction boundary. ### Attack Path 1. An attacker causes a matching release with a specially crafted title to appear in the Nyaa search results. 2. `scripts/search_nyaa.py` reads and HTML-decodes the remote title. 3. Ranking logic selects the crafted release as the best result. 4. `queue_download()` passes the untrusted title to `_magnet()`. 5. `_magnet()` concatenates the title directly into the URI. 6. The generated magnet link contains injected parameters such as an attacker-controlled tracker or web seed. 7. If the user opens the magnet link, the torrent client processes the injected parameters. ### Impact Assessment Successful exploitation can modify the semantics of a returned magnet URI. An attacker may add tracker or web-seed endpoints, potentially causing the u ...[truncated 378 chars]- Remediation
View remediation
str: if not re.fullmatch(r"(?:[0-9A-Fa-f]{40}|[A-Z2-7]{32})", infohash): raise ValueError("Invalid BitTorrent infohash") encoded_name = quote(name, safe="") return f"magnet:?xt=urn:btih:{infohash}&dn={encoded_name}" ``` Additional hardening should include: 1. Limit release-title length before including it in output. 2. Reject control characters in externally supplied titles. 3. Construct query parameters through a dedicated URI encoder rather than string concatenation. 4. Add tests using titles containing `&tr=`, `&ws=`, `#`, `%`, spaces, and Unicode characters. 5. Ensure callers convert validation failures into a structured `blocked` or fallback response rather than terminating unexpectedly. ]]>