T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/docx-converter.js:6
- Finding
- Generated HTML Is Written Without Security Sanitization## Vulnerability Details **File Location**: `scripts/docx-converter.js`, lines 6-8 **Vulnerability Type**: Unsanitized HTML generation from an untrusted DOCX document **Risk Level**: Medium **Vulnerable Code**: ```javascript const buffer = await fs.readFile(inputPath); const result = await mammoth.convertToHtml({ buffer: buffer }); await fs.writeFile(outputPath, result.value); ``` ### Technical Analysis The converter treats the DOCX input as potentially arbitrary content but writes the HTML returned by `mammoth.convertToHtml` directly to the selected output file. No allowlist-based HTML sanitization or URL-scheme validation is performed between conversion and output. Because the documented workflow recommends opening the resulting file in a browser, security-sensitive content preserved from an attacker-controlled document—particularly hyperlinks or other browser-interpreted values—may become active in the generated page. Dangerous URL schemes, unsafe embedded resources, or future parser edge cases could consequently expose users to stored cross-site scripting, unsafe navigation, or content injection. The Python wrapper does not introduce shell command injection because it invokes Node.js using an argument array rather than a shell. The issue is specifically the absence of a security boundary between untrusted document conversion and browser consumption. ### Attack Path 1. An attacker creates or supplies a crafted DOCX document containing a dangerous hyperlink or other browser-active content. 2. A user or automated system invokes the converter on that untrusted document. 3. `mammoth.convertToHtml` converts the document content into HTML. 4. The converter writes `result.value` to the output file without sanitization. 5. The user opens the generated file in a browser or embeds it in a web application, as described by the documented workflow. 6. If the dangerous content is preserved by the conversion process, the brows ...[truncated 868 chars]
- Remediation
- ## Remediation Suggestions 1. Pass `result.value` through a maintained, allowlist-based HTML sanitizer before writing or returning it. 2. Permit only the elements and attributes required by the conversion use case. 3. Remove event-handler attributes, scripts, active embedding elements, and other executable markup. 4. Validate hyperlink and resource URL schemes. Allow only explicitly required schemes such as `https`, `http`, and optionally `mailto`; reject `javascript`, unsafe `data` uses, and other active schemes. 5. Serve converted documents from an isolated origin that has no access to application cookies or sensitive browser storage. 6. When embedding generated output, use a sandboxed iframe without unnecessary permissions. 7. Apply a restrictive Content Security Policy that disables scripts and limits navigation, frames, objects, and resource origins. 8. Add regression tests using DOCX files containing dangerous links, event-like attributes, embedded resources, and malformed XML to verify that unsafe output is removed. 9. Document that converted documents must be treated as untrusted content even when conversion completes successfully.