Investigate vulnerability: Improper Authorization in Handler for Custom URL Scheme

[SGeeversAtVortech]

In GitLab by @bentvelsen on Jan 30, 2024, 11:33

Issue created from vulnerability 101832940

Description:

The application was found passing in a non-literal value to the urllib methods which issue
requests. urllib supports the file:// scheme, which may allow an adversary who can control
the URL value to read arbitrary files on the file system.

To remediate this issue either hardcode the URLs being used in urllib or use the requests
module instead.

Example using the requests module to issue an HTTPS request:

import requests
# Issue a GET request to https://example.com with a timeout of 10 seconds
response = requests.get('https://example.com', timeout=10)
# Work with the response object
# ...

• Severity: medium
• Location: src/rtctools/rtctoolsapp.py:111

Identifiers:

• CWE-939
• bandit.B310-1
• Bandit Test ID B310
• A5:2017 - Broken Access Control

Scanner:

• Name: Semgrep

[SGeeversAtVortech]

In GitLab by @bentvelsen on Jan 30, 2024, 11:34

I don't think this is an issue in our case, as we actually hardcode the url to be a https link to our gitlab repo. There is no way to change this link to for example the dangerous //file destination.