T09 · Insecure Skill Coding Practices
Warning
- Location
src/formatter.ts:136- Finding
Unsanitized Remote Data Enables Terminal Escape-Sequence Injection
- Content
View full analysis
{ const safeId = sanitizeOfferId(offer.id); return safeId ? `https://www.marktguru.de/offers/${safeId}` : null; })(), }; ``` ```ts const rows = deals.map((deal) => { const productDetails = formatProductDetails(deal); const url = deal.url ?? "-"; return [ pad(productDetails, headers.productDetails), pad(deal.store, headers.store), pad(deal.size, headers.size), pad(formatPrice(deal.price), headers.price), pad(formatPricePerLitre(deal.pricePerLitre), headers.litre), pad(`${deal.validFrom} – ${deal.validTo}`, headers.validity), url, ].join(" | "); }); return [headerLine, separator, ...rows].join("\n"); ``` ### Technical Analysis The product name, description, advertiser name, unit name, and potentially invalid date values originate from the remote Marktguru API. These strings are trimmed and truncated but are not sanitized for ANSI escape sequences, carriage returns, C0/C1 control characters, or terminal-specific operating system command sequences. The resulting values are included directly in the table returned by `formatDealsTable()` and subsequently passed to `console.log()`. Truncating a string does not make terminal control sequences safe because short escape sequences can still clear the screen, reposition the cursor, ...[truncated 1828 chars]- Remediation
View remediation