T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils/validator.js:3- Finding
Arbitrary URL Fetching Enables Private-Network Access and Unsafe Redirects
- Content
View full analysis
this.__opts.maxRedirects) { const err = new Error("Too many redirects"); this.__setState(this.__states.FAILED); this.emit("error", err); return reject(err); } const redirectedURL = /^https?:\/\//.test(response.headers.location) ? response.headers.location : new URL(response.headers.location, this.url).href; this.__isRedirected = true; this.__initProtocol(redirectedURL); this.emit("redirected", redirectedURL, this.url); return this.__start(); } ``` ```js // scripts/utils/download.js:591-598 __isRequireRedirect(response) { const redirectCodes = [301, 302, 303, 307, 308]; return ( redirectCodes.includes(response.statusCode) && response.headers.hasOwnProperty("location") && response.headers.location ); } ``` ```js // scripts/utils/download.js:975-997 __initProtocol(url) { const defaultOpts = this.__getReqOptions( this.__opts.method, url, this.__headers, ); this.requestURL = url; if (url.indexOf("https://") > -1) { this.__protocol = https; defaultOpts.agent = this.__defaultHttpsAgent; this.__reqOptions = Object.assign( {}, defaultOpts, this.__opts.httpsRequestOptions, ); } else { this.__protocol = http; defaultOpts.agent = this.__defaultHttpAgent; this.__re ...[truncated 2791 chars]- Remediation
View remediation