T09 · Insecure Skill Coding Practices
Warning
- Location
douyin.js:45- Finding
Unrestricted Outbound Requests Permit Blind Server-Side Request Forgery
- Content
View full analysis
{ const parsedUrl = new URL(url); const client = parsedUrl.protocol === 'https:' ? https : http; const opts = { method: options.method || 'GET', headers: { ...HEADERS, ...options.headers } }; const req = client.request(url, opts, (res) => { // 处理重定向 if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) { httpRequest(res.headers.location, options) .then(resolve) .catch(reject); return; } let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => { resolve({ statusCode: res.statusCode, headers: res.headers, body: data, url: url }); }); }); req.on('error', reject); req.setTimeout(30000, () => { req.destroy(); reject(new Error('Request timeout')); }); if (options.body) { req.write(options.body); } req.end(); }); } ``` ```js async function parseShareUrl(shareText) { const modalIdMatch = shareText.match(/(?:modal_id[=:])?(\d{16,})/); if (modalIdMatch) { const modalId = modalIdMatch[1]; return await getVideoInfoByModalId(modalId); } const urlMatch = shareText.match(/https?:\/\/[^\s]+/); if (!urlMatch) { throw new Error('未找到有效的分享链接'); } const shareUrl = urlMatch[0]; const response1 = await httpRequest(shareUrl); const finalUrl = response1.url; ``` ### Technical Analysis The CLI accepts an arbitrary HTTP or HTTPS URL from the user and passes it directly to `httpRequest()`. The request implementation does not: - Restrict requests to approved Douyin ...[truncated 2390 chars]- Remediation
View remediation