T09 · Insecure Skill Coding Practices
Error
- Location
scripts/parser/__init__.py:132- Finding
Server-Side Request Forgery Through Weak URL and Redirect Validation
- Content
View full analysis
VideoInfo: async with httpx.AsyncClient(follow_redirects=True) as client: response = await client.get(share_url, headers=self.get_default_headers()) response.raise_for_status() ``` `scripts/transcribe.py:137-151`: ```python def download_video(video_url, output_path): """ 下载视频文件到本地 """ print(f"正在下载视频: {video_url} -> {output_path}") headers = {"User-Agent": USER_AGENT} try: response = requests.get(video_url, headers=headers, stream=True, timeout=300) response.raise_for_status() with open(output_path, "wb") as f: for chunk in response.iter_content(chunk_size=8192): if chunk: f.write(chunk) print("视频下载完成") return True ``` `scripts/transcribe.py:247-254`: ```python # 使用外部 API parse_api_url = env_vars.get("parse_api_url", "") full_parse_url = f"{parse_api_url}{quote(video_url_to_parse)}" try: response = requests.get(full_parse_url, timeout=30) response.raise_for_status() parse_result = response.json() ``` ### Technical Analysis Platform detection searches for an allowed domain as a substring anywhere in the complete URL. It does not parse the URL and compare its actual hostname against the platform allowlist. Consequently, ...[truncated 3478 chars]- Remediation
View remediation
bool: hostname = hostname.rstrip(".").lower() allowed = allowed.rstrip(".").lower() return hostname == allowed or hostname.endswith("." + allowed) ``` 4. Resolve the hostname before connecting and reject every resolved loopback, private, link-local, multicast, unspecified, or reserved IP address using Python's `ipaddress` module. 5. Disable automatic redirects and validate the scheme, hostname, and resolved address of every redirect target before following it. 6. Apply the same validation to `video_url` values returned by local parsers, external parsing APIs, and `--parse_result`. 7. Restrict media downloads to documented platform/CDN domains where operationally possible. 8. Enforce response size limits by checking `Content-Length` and stopping streamed downloads after a configured maximum. 9. Validate expected media content types before writing and processing responses. 10. Apply network-level egress controls that deny access to loopback, private networks, and cloud metadata ranges as defense in depth. 11. Treat externally supplied parse results as untrusted input and validate their complete schema before use. ]]>