T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_movie_page.py:257- Finding
Unvalidated Streaming URLs Are Loaded into an Unsandboxed iframe
- Content
View full analysis
str: """Build HTML for source selector buttons (with data-src for JS switching).""" if not sources: return "" buttons = [] for i, src in enumerate(sources): name = _escape_html(src.get("name", f"Source {i+1}")) url = _escape_html(src.get("url", "")) active = "active" if i == 0 else "" buttons.append( f'{name}' ) ``` The first supplied URL becomes the default iframe source without scheme or origin validation: ```python genre_tags = _build_genre_tags(genres) source_buttons = _build_source_buttons(sources) primary_src = sources[0]["url"] if sources else "" ``` The resulting iframe has no `sandbox` attribute and grants several browser capabilities: ```html ``` The untrusted source list originates directly from command-line JSON: ```python sources = [] if args.source ...[truncated 3152 chars]- Remediation
View remediation