T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mcp_client.py:101- Finding
Fail-Open URL Validation Permits DNS Rebinding and Server-Side Request Forgery
- Content
View full analysis
Optional[str]: """Allow only HTTPS document URLs and reject local/private targets.""" parsed = urlparse(url) if parsed.scheme.lower() != "https": return "Only HTTPS document URLs are allowed." if not parsed.netloc: return "Document URL must include a hostname." hostname = parsed.hostname if not hostname: return "Document URL must include a valid hostname." normalized = hostname.lower() if normalized == "localhost" or normalized.endswith(".local"): return "Local hostnames are not allowed." try: ip = ipaddress.ip_address(hostname) except ValueError: resolved_ips = resolve_hostname_ips(hostname) if not resolved_ips: return None if any(is_disallowed_ip(candidate) for candidate in resolved_ips): return "Hostnames that resolve to private or local network IPs are not allowed." return None if is_disallowed_ip(ip): return "Private or local network URLs are not allowed." return None ``` The accepted URL is subsequently sent to the WebPrinter service: ```python def create_roaming_task(self, file_name: str, url: str, media_format: str) -> Dict[str, Any]: error = validate_https_url(url) if error: return {"error": error} data = {"fileName": file_name, "url": url, "mediaFormat": media_format} return self._send_request("POST", "/openapi/task/createRoamingTask", data, raw_response=True) ``` ```python def direct_print_document( self, file_name: str, url: str, media_format: str, device_name: str, control_sn: str, ) -> ...[truncated 2773 chars]- Remediation
View remediation