T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/notifier.py:82- Finding
Unescaped Dynamic Values in Telegram HTML Notifications
- Content
View full analysis
价格警报 代币： {token.upper()} 当前价格： ${current_price:,.2f} 目标价格： ${target_price:,.2f} 条件： {direction} 时间： {datetime.now().strftime('%Y-%m-%d %H:%M:%S')} #SolanaMonitor #PriceAlert """ return self.send_message(message) def send_whale_alert(self, signature: str, amount: float, token: str, from_addr: str, to_addr: str) -> bool: message = f""" 🐋 巨鲸转账警报 金额： {amount:,.2f} {token.upper()} 来源：{from_addr[:16]}...{from_addr[-8:]}目标：{to_addr[:16]}...{to_addr[-8:]}交易： 查看 时间： {datetime.now().strftime('%Y-%m-%d %H:%M:%S')} #SolanaMonitor #WhaleAlert """ return self.send_message(message) ``` The resulting messages are passed to `send_message()`, whose default parsing mode is HTML: ```python def send_message(self, message: str, parse_mode: str = 'HTML') -> bool: ``` ### Technical Analysis The notification functions interpolate `token`, `from_addr`, `to_addr`, and `signature` directly into content rendered by Telegram as HTML. These values are not HTML-escaped or validated before insertion. If an attacker can influence any of these fields through a future API integration, monitored data source, plugin, or direct invocation of `NotificationManager.send_alert()`, HTML metacharacters may alter the structure or presentation of the notification. The `signature` value is particularly sensitive because it is inserted into an HTML link attribute. Telegram restricts the HTML elements it supports, limiting the scope compared with browser-based HTML injection. Nevertheless, crafted values may create misleading formatting, alter links, produce de ...[truncated 1278 chars]- Remediation
View remediation
`, `&`, quotation marks, closing tags, and fake link markup. Confirm that the resulting message displays these values literally and cannot introduce new Telegram entities. 6. Treat all alert fields as untrusted at the notification boundary, even when current callers normally obtain them from public blockchain or pricing services. ]]>