T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch.js:354- Finding
Arbitrary URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
a.startsWith('http')); if (!urls.length) { console.log(JSON.stringify({ error: '未传入有效 URL' })); process.exit(1); } ``` The fetched content is returned to the caller: ```js const settled = await Promise.allSettled(tasks); const results = settled.map(r => r.status === 'fulfilled' ? r.value : { url: '?', status: 0, content: '', error: String(r.reason) } ); console.log(JSON.stringify(results, null, 2)); ``` ### Technical Analysis The fetch functionality accepts caller-controlled URLs and passes them to both the Node.js `fetch` API and Playwright without destination validation. Checking only whether a string begins with `http` does not establish that it is a valid public HTTP or HTTPS destination. The implementation does not: - Restrict the parsed protocol to exactly `http:` or `https:`. - Reject loopback addresses such as `127.0.0.1` or `::1`. - Reject RFC 1918 private network addresses. - Reject link-local, multicast, reserved, or IPv4-mapped IPv6 addresses. - Block local hostnames such as `localhost`. - Resolve hostnames and validate all resulting IP addresses. - Protect against DNS rebinding. - Validate each destination in a red ...[truncated 1956 chars]- Remediation
View remediation