T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/build_url.py:79- Finding
Unvalidated supplier subdomain permits arbitrary-host URL generation
- Content
View full analysis
str: """ Build supplier company profile URL. Args: subdomain: Supplier's subdomain (e.g., 'dgkunteng') Returns: Complete supplier profile URL with traffic_type=ags_llm """ return f"https://{subdomain}.en.alibaba.com/company_profile.html?traffic_type={TRAFFIC_TYPE}" def build_supplier_search_url(subdomain: str, query: str) -> str: """ Build supplier product search URL. Args: subdomain: Supplier's subdomain query: Search keywords within supplier's products Returns: Complete supplier search URL with traffic_type=ags_llm """ return f"https://{subdomain}.en.alibaba.com/search/product?SearchText={encode_search_query(query)}&traffic_type={TRAFFIC_TYPE}" ``` The affected value is accepted directly from the command line at `scripts/build_url.py:155-156` and used at `scripts/build_url.py:184-189`: ```python supplier_parser.add_argument('subdomain', help='Supplier subdomain') supplier_parser.add_argument('--search', '-s', help='Search within supplier products') elif args.command == 'supplier': if args.search: url = build_supplier_search_url(args.subdomain, args.search) else: url = build_supplier_url(args.subdomain) print(url) ``` ### Technical Analysis The supplier `subdomain` is interpolated into a URL without validating that it is a single DNS label. Although the generated string visually ends with `.en.alibaba.com`, URL delimiters supplied inside `subdomain` can change how a browser or URL parser interprets the destination. For example, the following value contains a path delimiter: ```text attacker.example/path? ``` It produces a URL resembling: ```text https://attacker.example/path? ...[truncated 1868 chars]- Remediation
View remediation
str: if not SUPPLIER_LABEL_RE.fullmatch(subdomain): raise ValueError("Supplier subdomain must be a single valid DNS label") return subdomain.lower() def verify_alibaba_supplier_url(url: str) -> str: parsed = urllib.parse.urlsplit(url) if ( parsed.scheme != "https" or not parsed.hostname or not parsed.hostname.endswith(".en.alibaba.com") ): raise ValueError("Generated URL is not an Alibaba supplier URL") return url def build_supplier_url(subdomain: str) -> str: label = validate_supplier_subdomain(subdomain) url = ( f"https://{label}.en.alibaba.com/company_profile.html" f"?traffic_type={TRAFFIC_TYPE}" ) return verify_alibaba_supplier_url(url) ``` Apply the same validation to `build_supplier_search_url()`. Where possible, build query strings with `urllib.parse.urlencode()` rather than manual concatenation. ]]>