T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ds160-filler.js:326- Finding
CSV Values Are Interpolated into Dynamically Evaluated Browser JavaScript
- Content
View full analysis
o.text === '${valueToFill}' || o.value === '${valueToFill}'); if (!option) { option = options.find(o => o.text.includes('${valueToFill}') || o.value.includes('${valueToFill}')); } if (option) { el.value = option.value; el.dispatchEvent(new Event('change', { bubbles: true })); true; } else { false; } } else { false; } `; break; case 'checkbox': fillScript = ` const el = ${locator}; if (el) { const shouldBeChecked = '${valueToFill}'.toLowerCase() === 'true' || '${valueToFill}'.toLowerCase() === 'yes'; if (el.checked !== shouldBeChecked) { el.click(); } true; } else { false; } `; break; ``` ### Technical Analysis `valueToFill` originates from CSV user data and is inserted directly into JavaScript source code. It is not escaped or passed as a separate argument before the resulting string is supplied to `page.evaluate`. A CSV val ...[truncated 2197 chars]- Remediation
View remediation
{ const el = document.getElementById(elementId); if (!el) { return false; } el.value = value; el.dispatchEvent(new Event('input', { bubbles: true })); el.dispatchEvent(new Event('change', { bubbles: true })); return true; }, { elementId, value: valueToFill } ); ``` - Use browser automation APIs such as `fill`, `type`, `selectOption`, `check`, and `click` instead of evaluated source whenever available. - Pass selectors and identifiers as callback arguments rather than embedding them in executable strings. - Validate each CSV field against its expected data type, maximum length, format, and allowed values. - For select fields, require an exact match against the configured option set rather than using unrestricted substring matching. - Add regression tests containing quotes, backslashes, line breaks, template-literal characters, and representative JavaScript payload strings. ]]>