T09 · Insecure Skill Coding Practices
Warning
- Location
academic_citation_skill.py:510- Finding
Unvalidated Crossref API Base URL Enables Server-Side Request Forgery
- Content
View full analysis
Dict: """加载配置文件""" config_path = Path(__file__).parent / config_file try: with open(config_path, 'r', encoding='utf-8') as f: return json.load(f) except FileNotFoundError: return { "api_base": "https://api.crossref.org", "rate_limit": 10, "cache_ttl": 86400 } def fetch_by_doi(self, doi: str) -> Optional[Dict]: """通过DOI获取文献信息""" cache_key = f"doi_{doi}" if cache_key in self.cache: logger.info(f"Using cached result for DOI: {doi}") return self.cache[cache_key] self._rate_limit_wait() try: url = f"{self.config['api_base']}/works/{doi}" logger.info(f"Fetching DOI from: {url}") response = self.session.get(url, timeout=15) if response.status_code == 200: data = response.json() result = self._parse_crossref_response(data) self.cache[cache_key] = result logger.info(f"Successfully fetched reference: {result.get('title', 'Unknown')}") return result elif response.status_code == 404: logger.warning(f"DOI not found: {doi}") else: logger.error(f"Failed to fetch DOI {doi}: HTTP {response.status_code}") except requests.exceptions.Timeout: logger.error(f"Timeout fetching DOI: {doi}") except Exception as e: logger.error(f"Error fetching DOI {doi}: {str(e)}") return None def search_by_title_author(self, title: str, author: str = None, year: int = None, max_results: int = 10) -> List[Dict]: """通过标题和作者搜索文献""" self._rate_limit_wait() try: para ...[truncated 3385 chars]- Remediation
View remediation