T09 · Insecure Skill Coding Practices
Error
- Location
revealjs/scripts/create-presentation.js:29- Finding
HTML Injection Through Unescaped Presentation Metadata
- Content
View full analysis
${options.title} ``` ### Technical Analysis The `--title` and `--styles` command-line values are inserted directly into different HTML contexts without escaping or validation. The title is interpolated into an HTML text context, while the stylesheet value is interpolated into a quoted HTML attribute. An attacker can provide markup containing closing tags or quotation marks to escape the intended context and inject additional HTML or JavaScript. For example, a title containing a closing `title` element followed by a `script` element would be written unchanged into the generated presentation. The injected script would execute when the resulting HTML file is opened in a browser. The stylesheet parameter is similarly susceptible to attribute injection because characters such as double quotes and angle brackets are not rejected or encoded. ### Attack Path 1. An attacker supplies presentation metadata containing an HTML payload, directly or through a request processed by an Agent. 2. The Agent follows the documented workflow and invokes `create-presentation.js` ...[truncated 1036 chars]- Remediation
View remediation