T09 · Insecure Skill Coding Practices
- Location
scripts/docx-converter.js:6- Finding
Generated HTML Is Written Without Security Sanitization
- Content
View full analysis
Vulnerability Details
File Location:
scripts/docx-converter.js, lines 6-8
Vulnerability Type: Unsanitized HTML generation from an untrusted DOCX document
Risk Level: MediumVulnerable Code:
javascript const buffer = await fs.readFile(inputPath); const result = await mammoth.convertToHtml({ buffer: buffer }); await fs.writeFile(outputPath, result.value);Technical Analysis
The converter treats the DOCX input as potentially arbitrary content but writes the HTML returned by
mammoth.convertToHtmldirectly to the selected output file. No allowlist-based HTML sanitization or URL-scheme validation is performed between conversion and output.Because the documented workflow recommends opening the resulting file in a browser, security-sensitive content preserved from an attacker-controlled document—particularly hyperlinks or other browser-interpreted values—may become active in the generated page. Dangerous URL schemes, unsafe embedded resources, or future parser edge cases could consequently expose users to stored cross-site scripting, unsafe navigation, or content injection.
The Python wrapper does not introduce shell command injection because it invokes Node.js using an argument array rather than a shell. The issue is specifically the absence of a security boundary between untrusted document conversion and browser consumption.
Attack Path
- An attacker creates or supplies a crafted DOCX document containing a dangerous hyperlink or other browser-active content.
- A user or automated system invokes the converter on that untrusted document.
mammoth.convertToHtmlconverts the document content into HTML.- The converter writes
result.valueto the output file without sanitization. - The user opens the generated file in a browser or embeds it in a web application, as described by the documented workflow.
- If the dangerous content is preserved by the conversion process, the brows ...[truncated 868 chars]
- Remediation
View remediation
Remediation Suggestions
- Pass
result.valuethrough a maintained, allowlist-based HTML sanitizer before writing or returning it. - Permit only the elements and attributes required by the conversion use case.
- Remove event-handler attributes, scripts, active embedding elements, and other executable markup.
- Validate hyperlink and resource URL schemes. Allow only explicitly required schemes such as
https,http, and optionallymailto; rejectjavascript, unsafedatauses, and other active schemes. - Serve converted documents from an isolated origin that has no access to application cookies or sensitive browser storage.
- When embedding generated output, use a sandboxed iframe without unnecessary permissions.
- Apply a restrictive Content Security Policy that disables scripts and limits navigation, frames, objects, and resource origins.
- Add regression tests using DOCX files containing dangerous links, event-like attributes, embedded resources, and malformed XML to verify that unsafe output is removed.
- Document that converted documents must be treated as untrusted content even when conversion completes successfully.
- Pass