T09 · Insecure Skill Coding Practices
Error
- Location
- helpers/douyin_grab.py:31
- Finding
- Browser session cookies may be disclosed to an untrusted media endpoint## Vulnerability Details **File Location**: `helpers/douyin_grab.py`, lines 31–64 **Vulnerability Type**: Unvalidated destination combined with sensitive cookie forwarding **Risk Level**: High ### Vulnerable Code ```python def fetch_page_snapshot(): js = r'''JSON.stringify({ url: location.href, title: document.title, bodyText: document.body ? document.body.innerText.slice(0,12000) : "", metas: Array.from(document.querySelectorAll("meta")).map(m=>({name:m.getAttribute("name"), property:m.getAttribute("property"), content:m.getAttribute("content")})).filter(x=>x.content).slice(0,80), resources: performance.getEntriesByType("resource").map(r=>r.name).filter(n => /douyinvod|media-audio|media-video|aweme\/detail/.test(n)).slice(0,400), cookie: document.cookie, ua: navigator.userAgent })''' return json.loads(chrome_eval(js)) def pick_audio_url(resources): for u in resources: if "media-audio" in u: return u return None def sanitize_cookie(raw_cookie: str) -> str: # keep it simple; curl can take the raw cookie string return raw_cookie.strip() def download_audio(audio_url: str, page_url: str, cookie: str, ua: str, out_path: Path): cmd = [ "curl", "-L", audio_url, "-H", f"User-Agent: {ua}", "-H", f"Referer: {page_url}", "-H", "Origin: https://www.douyin.com", "-H", f"Cookie: {cookie}", "-H", "Accept: */*", "-o", str(out_path), "-sS", ] ``` ### Technical Analysis The script extracts the complete JavaScript-accessible cookie string from the currently loaded browser page. It then selects a media URL solely by checking whether the resource URL contains the substring `media-audio`. There is no validation of the selected URL's scheme, hostname, port, or relationship to Douyin. The cookie is subsequently supplied as an explicit HTTP ...[truncated 1929 chars]
- Remediation
- ## Remediation Suggestions 1. Validate the initial user URL before opening it: - Require HTTPS. - Allow only documented Douyin domains. - Normalize internationalized domain names and reject deceptive suffix matches. 2. Validate every candidate media URL: - Parse it with `urllib.parse.urlsplit`. - Require an exact allowlisted hostname or a carefully defined trusted CDN suffix. - Reject embedded credentials, unexpected ports, non-HTTPS schemes, and malformed URLs. - Do not rely on substring matching. 3. Do not forward the complete page cookie string: - Prefer unauthenticated media downloads where possible. - If authentication is required, select only the minimum necessary cookie names. - Use an isolated browser profile with no unrelated authenticated sessions. 4. Handle redirects explicitly: - Disable unrestricted `curl -L`. - Inspect and validate each redirect destination before following it. - Never forward a manually supplied `Cookie` header when the destination origin changes. - Set a small maximum redirect count. 5. Add tests covering: - Attacker-controlled URLs containing `media-audio`. - Cross-origin redirects. - Subdomain confusion such as `douyin.com.attacker.example`. - Non-HTTPS media URLs.