T09 · Insecure Skill Coding Practices
Error
- Location
scripts/videogen.py:280- Finding
Unvalidated Server-Provided URLs and Unsafe Output Path Construction
- Content
View full analysis
Vulnerability Details
File Location:
scripts/videogen.py, lines 280–290 and 312–414
Vulnerability Type: Unvalidated remote URLs, server-side request forgery from the client environment, and path traversal
Risk Level: HighVulnerable Code
python upload_url = token["upload"]["url"] upload_method = token["upload"].get("method", "PUT") upload_headers = token["upload"].get("headers", {}) # PUT to object storage without the API key, using returned headers print(f"[2/3] Uploading file to object storage...") with open(str(path), "rb") as f: try: oss_resp = requests.request( upload_method, upload_url, headers=upload_headers, data=f, timeout=300, ) except requests.exceptions.RequestException as e: raise SystemExit( f"OSS upload network error: {e}\n" "Check the network connection or whether the file is too large" )python def download_file(url, out_path, timeout=300): """Stream a file download with progress display.""" print(f"[download] {out_path.name}") try: resp = requests.get(url, stream=True, timeout=timeout) resp.raise_for_status() total = int(resp.headers.get("content-length", 0)) downloaded = 0 with open(str(out_path), "wb") as f: for chunk in resp.iter_content(chunk_size=8192): if chunk: f.write(chunk) downloaded += len(chunk)python task_type = task.get("taskType", "task") for i, item in enumerate(succeeded): result_url = item.get("resultUrl") if not result_url: continue ext = ".mp4" if "video" in task_type.lower() else ".png" filename = f"{task_type}_{task_id}_{i+1}{ext}" out_path = out_dir / filename download_file(result_url, out_path) # Last frame for item in succeeded: last_fram ...[truncated 3210 chars]- Remediation
View remediation
Remediation Suggestions
- Permit only
httpsURLs for uploads and downloads. - Maintain explicit allowlists for expected API, object-storage, and result-delivery domains.
- Resolve hostnames and reject loopback, link-local, private, multicast, reserved, and cloud metadata address ranges.
- Disable automatic redirects or validate every redirect target before following it.
- Restrict upload methods to the documented set, preferably only
PUTorPOST. - Validate returned upload headers and reject sensitive or unexpected header names.
- Normalize
taskTypeand task identifiers to a strict filename-safe character set, such as ASCII letters, digits, underscores, and hyphens. - Construct the output path, resolve it with
Path.resolve(), and verify that it remains beneath the resolved output directory before opening the file. - Use exclusive file creation or an explicit overwrite policy to prevent silent replacement of existing files.
- Apply maximum download-size limits and verify that returned content types match the expected media type.
- Permit only