T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/pixellab_client.py:302- Finding
Unrestricted Server-Provided Asset URLs Enable Server-Side Request Forgery
- Content
View full analysis
Iterable[str]: if isinstance(obj, str): if looks_like_url(obj) and is_asset_url_path(path): yield obj return if isinstance(obj, dict): for key, value in obj.items(): yield from iter_asset_urls(value, path + (normalize_key(key),)) elif isinstance(obj, list): for item in obj: yield from iter_asset_urls(item, path) ``` ```python def download_one(url: str, destination: pathlib.Path, timeout: int, max_bytes: int) -> None: total = 0 request = urllib.request.Request( url, headers={ "User-Agent": "pixellab-ai-skill/1.5 (+https://www.pixellab.ai/)", "Accept": "image/png,image/*,*/*", }, ) with urllib.request.urlopen(request, timeout=timeout) as resp, open(destination, "wb") as f: while True: chunk = resp.read(1024 * 256) if not chunk: break total += len(chunk) if total > max_bytes: raise RuntimeError(f"download exceeded {max_bytes} bytes") f.write(chunk) ``` ```python request_urls = set(iter_all_urls(payload)) discovered_urls = [url for url in iter_asset_urls(result) if url not in request_urls] output: Any = result decoded_files: list[str] = [] downloaded_files: list[str] = [] download_errors: list[str] = [] if args.download_dir: output_dir = pathlib.Path(args.download_dir) if discovered_urls: downloaded_files, download_errors = download_assets( discovered_urls, output_dir, timeout=args.timeout, max_byte ...[truncated 2672 chars]- Remediation
View remediation