T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/order-dashboard.js:192- Finding
Terminal Escape-Sequence Injection Through Untrusted Order Fields
- Content
View full analysis
1 ? `${order.product_list.length} items` : order.product_list[0]?.sku || 'N/A'; const row = [ order.order_id, order.customer_company?.substring(0, 20) || order.customer_name, productSummary, order.quantity.toString(), formatCurrency(order.total_amount, order.currency), colorizeStatus(order.status), formatDate(order.delivery_date), daysLabel, ]; console.log(row.join(' │ ')); } ``` Other affected output paths similarly interpolate order data directly: ```js console.log(` Name: ${order.customer_name}`); console.log(` Company: ${order.customer_company}`); console.log(` Email: ${order.customer_email}`); console.log(` "${entry.notes}"`); ``` ### Technical Analysis The dashboard reads order records from `data/orders.json` and writes their string fields directly to an ANSI-capable terminal. It does not remove escape sequences, C0/C1 control characters, carriage returns, or other terminal control data. The bundled order file is local, but the project explicitly supports manually maintained order records. Therefore, data copied from an external source or supplied by a less-trusted user can contain sequences su ...[truncated 1487 chars]- Remediation
View remediation