T09 · Insecure Skill Coding Practices
- Location
helpers/douyin_grab.py:31- Finding
Browser session cookies may be disclosed to an untrusted media endpoint
- Content
View full analysis
Vulnerability Details
File Location:
helpers/douyin_grab.py, lines 31–64
Vulnerability Type: Unvalidated destination combined with sensitive cookie forwarding
Risk Level: HighVulnerable Code
python def fetch_page_snapshot(): js = r'''JSON.stringify({ url: location.href, title: document.title, bodyText: document.body ? document.body.innerText.slice(0,12000) : "", metas: Array.from(document.querySelectorAll("meta")).map(m=>({name:m.getAttribute("name"), property:m.getAttribute("property"), content:m.getAttribute("content")})).filter(x=>x.content).slice(0,80), resources: performance.getEntriesByType("resource").map(r=>r.name).filter(n => /douyinvod|media-audio|media-video|aweme\/detail/.test(n)).slice(0,400), cookie: document.cookie, ua: navigator.userAgent })''' return json.loads(chrome_eval(js)) def pick_audio_url(resources): for u in resources: if "media-audio" in u: return u return None def sanitize_cookie(raw_cookie: str) -> str: # keep it simple; curl can take the raw cookie string return raw_cookie.strip() def download_audio(audio_url: str, page_url: str, cookie: str, ua: str, out_path: Path): cmd = [ "curl", "-L", audio_url, "-H", f"User-Agent: {ua}", "-H", f"Referer: {page_url}", "-H", "Origin: https://www.douyin.com", "-H", f"Cookie: {cookie}", "-H", "Accept: */*", "-o", str(out_path), "-sS", ]Technical Analysis
The script extracts the complete JavaScript-accessible cookie string from the currently loaded browser page. It then selects a media URL solely by checking whether the resource URL contains the substring
media-audio.There is no validation of the selected URL's scheme, hostname, port, or relationship to Douyin. The cookie is subsequently supplied as an explicit HTTP ...[truncated 1929 chars]
- Remediation
View remediation
Remediation Suggestions
-
Validate the initial user URL before opening it:
- Require HTTPS.
- Allow only documented Douyin domains.
- Normalize internationalized domain names and reject deceptive suffix matches.
-
Validate every candidate media URL:
- Parse it with
urllib.parse.urlsplit. - Require an exact allowlisted hostname or a carefully defined trusted CDN suffix.
- Reject embedded credentials, unexpected ports, non-HTTPS schemes, and malformed URLs.
- Do not rely on substring matching.
- Parse it with
-
Do not forward the complete page cookie string:
- Prefer unauthenticated media downloads where possible.
- If authentication is required, select only the minimum necessary cookie names.
- Use an isolated browser profile with no unrelated authenticated sessions.
-
Handle redirects explicitly:
- Disable unrestricted
curl -L. - Inspect and validate each redirect destination before following it.
- Never forward a manually supplied
Cookieheader when the destination origin changes. - Set a small maximum redirect count.
- Disable unrestricted
-
Add tests covering:
- Attacker-controlled URLs containing
media-audio. - Cross-origin redirects.
- Subdomain confusion such as
douyin.com.attacker.example. - Non-HTTPS media URLs.
- Attacker-controlled URLs containing
-