T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/hotel_analysis.py:73
- Finding
- Unescaped User-Controlled Data Injected into Generated Markdown Reports<![CDATA[ ## Vulnerability Details **File Location**: `scripts/hotel_analysis.py:73-93` **Additional Input Source**: `scripts/hotel_analysis.py:153-164` **Vulnerability Type**: Markdown content injection **Risk Level**: Medium ### Vulnerable Code ```python # Target hotel report.append("## Target Hotel") report.append("") report.append(f"- **Name**: {self.hotel_name}") report.append("") # Competitor list report.append("## Competitors (Manually Entered)") report.append("") if self.competitors: report.append("| Hotel Name | Distance | Rating | Price |") report.append("|------------|----------|--------|-------|") for comp in self.competitors: name = comp.get('name', '-') distance = comp.get('distance', '-') rating = comp.get('rating', '-') price = comp.get('price', '-') report.append(f"| {name} | {distance} | {rating} | {price} |") ``` The original source contains Chinese report labels, but the vulnerable interpolation operations are: ```python report.append(f"- **名称**: {self.hotel_name}") report.append(f"| {name} | {distance} | {rating} | {price} |") ``` The values can be supplied through command-line arguments or an Excel workbook: ```python if args.competitors: separators = [',', '，', ';', '；', '、'] comps = args.competitors for sep in separators: comps = comps.replace(sep, ',') comp_list = [c.strip() for c in comps.split(',') if c.strip()] for comp in comp_list: analysis.add_competitor(comp) if args.input: try: import pandas as pd df = pd.read_excel(args.input) for _, row in df.iterrows(): analysis.add_competitor( name=row.get('酒店名称'), distance=row.get('距离'), rating=row.get('评分'), price=row.get('价格区间') ) ``` ### Technical Analysis The hotel name and competitor fields are inserted directly into Markdown without escaping or normalization. The applic ...[truncated 1986 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Escape all untrusted fields before inserting them into Markdown: - Escape backslashes, pipes, brackets, parentheses, asterisks, underscores, angle brackets, and other Markdown control characters. - Replace carriage returns and line feeds with spaces. - Encode or reject raw HTML delimiters. 2. Validate each imported field: - Require hotel names to be strings. - Enforce reasonable maximum lengths. - Require ratings and prices to have expected numeric formats. - Normalize distance values rather than retaining arbitrary text. 3. Use a dedicated Markdown-escaping function for every dynamic value. 4. If reports are rendered in an application, disable raw HTML and remote-resource loading where possible. 5. Treat imported Excel files as untrusted input and reject cells containing control characters or unsupported data types. 6. Add tests covering table delimiters, embedded links, image syntax, HTML, and multiline input. ]]>