T09 · Insecure Skill Coding Practices
Error
- Location
scripts/web-monitor.sh:30- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
/dev/null) echo "$http_code" } ``` The URL is accepted directly from a command-line argument: ```bash cmd_add_task() { local url="" frequency="daily" selector="" threshold="5" notify="feishu" name="" while [[ $# -gt 0 ]]; do case "$1" in --url) url="$2"; shift 2 ;; --frequency) frequency="$2"; shift 2 ;; --selector) selector="$2"; shift 2 ;; --threshold) threshold="$2"; shift 2 ;; --notify) notify="$2"; shift 2 ;; --name) name="$2"; shift 2 ;; *) shift ;; esac done ``` The stored value is later fetched without destination validation: ```bash local url selector threshold url=$(echo "$task" | jq -r '.url') selector=$(echo "$task" | jq -r '.selector // ""') threshold=$(echo "$task" | jq -r '.threshold // "5"') log "INFO" "开始检查任务 $task_id: $url" # 抓取页面 local tmp_html tmp_html=$(mktemp /tmp/web-monitor-XXXXXX.html) local http_code http_code=$(fetch_page "$url" "$tmp_html") ``` ### Technical Analysis The monitoring URL is entirely user-controlled and is passed to `curl` without validation of: - The URL scheme. - The initial hostname or resolved IP address. - Loopback, private, link-local, multicast, and reserved address ranges. - ...[truncated 2512 chars]- Remediation
View remediation