T09 · Insecure Skill Coding Practices
Error
- Location
scripts/fetch_xhs_content.py:93- Finding
Unrestricted URL Fetching Enables SSRF and Local Resource Access
- Content
View full analysis
tuple[int | None, str | None, str]: marker_code = "__HTTP_CODE__:" marker_url = "__URL_EFFECTIVE__:" cmd = [ "curl", "-sL", "-A", user_agent, "--max-redirs", "5", "--connect-timeout", str(timeout_s), url, "-w", f"\n{marker_code}%{{http_code}}\n{marker_url}%{{url_effective}}\n", ] proc = subprocess.run(cmd, capture_output=True, text=True, errors="ignore") out = proc.stdout or "" ``` ```python url: str = args.url http_code: int | None = None effective_url: str | None = None html: str http_code, effective_url, html = fetch_html_with_curl( url, timeout_s=args.timeout_s, user_agent=args.user_agent ) ``` The shell implementation has the same behavior: ```sh URL="" while [ $# -gt 0 ]; do case "$1" in --url) URL="${2:-}" shift 2 ;; ``` ```sh meta="$( curl -sL \ -A "$UA" \ --max-redirs 5 \ --connect-timeout "$TIMEOUT_S" \ -o "$tmp_html" \ -w "\n${marker_code}%{http_code}\n${marker_url}%{url_effective}\n" \ "$URL" 2>/dev/null || true )" ``` ### Technical Analysis Both implementations pass the caller-controlled URL directly to `curl`. They do not validate: - The URL scheme - The initial hostname - Embedded URL credentials - The resolved IP address - Redirect destinations - Whether the destination belongs to an approved Xiaohongshu domain - Whether the destination is loopback, private, link-local, reserved, or multicast The `-L` option automatically follows as many as five redirects. Consequently, even an initially accepta ...[truncated 2115 chars]- Remediation
View remediation