T09 · Insecure Skill Coding Practices
Error
- Location
plugins/core/content-extractor.js:421- Finding
Server-Side Request Forgery Through Unrestricted URL Extraction
- Content
View full analysis
raw.replace(/[)\]}",;。！？!?.]+$/g, "")) .filter(Boolean); const uniqueUrls = Array.from(new Set(urls)); if (uniqueUrls.length === 0) { throw new Error("No URL detected", true); } return uniqueUrls; } ``` ```js async extractGeneric(url) { const response = await axios.get(url, { timeout: this.config.timeout, headers: { "User-Agent": this.config.userAgent }, }); const $ = cheerio.load(response.data); return { type: "webpage", title: $("title").text() || $('meta[property="og:title"]').attr("content") || "Untitled webpage", author: $('meta[name="author"]').attr("content") || "Unknown author", description: $('meta[property="og:description"]').attr("content") || $('meta[name="description"]').attr("content") || "", text: $("article").text() || $("main").text() || $("body").text() || "", publishTime: $('meta[property="article:published_time"]').attr("content") || "", images: $("img") .map((_, el) => ({ url: $(el).attr("src"), alt: $(el).attr("alt") || "", })) .get() .filter((img) => img.url), url, }; } ``` ### Technical Analysis The validation layer accepts any string beginning with `http://` or `https://`. It does not parse and validate the destination host, resolve DNS, reject non-public addresses, or constrain requests to an allowlist. The generic extractor then sends a server-side request to ...[truncated 2227 chars]- Remediation
View remediation