T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/create_invite_ics.py:31
- Finding
- Unescaped User-Controlled Data Permits iCalendar Content Injection## Vulnerability Details **File Location**: `scripts/create_invite_ics.py`, lines 31–53 **Vulnerability Type**: iCalendar content injection caused by missing RFC 5545 escaping **Risk Level**: Medium ### Vulnerable Code ```python def build_ics(event: dict) -> str: start = to_dt(event["start_time"]) end = to_dt(event.get("end_time")) if event.get("end_time") else start + timedelta(minutes=30) uid = f"{uuid4()}@show-booking" created = datetime.now(timezone.utc) summary = f"Showing: {event['address']}" desc = event.get("notes", "Real estate showing booked by AI calling workflow.") location = event["address"] return "\n".join( [ "BEGIN:VCALENDAR", "VERSION:2.0", "PRODID:-//show-booking//EN", "BEGIN:VEVENT", f"UID:{uid}", f"DTSTAMP:{format_ics_time(created)}", f"DTSTART:{format_ics_time(start)}", f"DTEND:{format_ics_time(end)}", f"SUMMARY:{summary}", f"DESCRIPTION:{desc}", f"LOCATION:{location}", "END:VEVENT", "END:VCALENDAR", "", ] ) ``` ### Technical Analysis The `address` and `notes` fields originate from the input JSON and are interpolated directly into iCalendar content. The implementation does not validate line breaks or escape RFC 5545 text delimiters such as backslashes, commas, and semicolons. An attacker who can influence a confirmed-showing record can include carriage-return or newline characters in these fields. These characters terminate the intended property and introduce additional iCalendar properties or components. Depending on the behavior of the receiving calendar application, injected content could include misleading organizer or attendee information, alarms, descriptions, links, or additional event metadata. ### Attack Path 1. An attacker supplies or influences a confirmed-showing JSON record. 2. The attacker inserts newli ...[truncated 997 chars]
- Remediation
- ## Remediation Suggestions 1. Apply RFC 5545 text escaping before inserting external values into the generated document: - Escape backslashes as `\\`. - Escape commas as `\,`. - Escape semicolons as `\;`. - Encode line breaks as literal `\n` sequences rather than allowing raw CR or LF characters. 2. Explicitly reject carriage-return and newline characters in fields that should remain single-line, particularly `address`. 3. Validate the input JSON against a strict schema, including required field types, lengths, and accepted timestamp formats. 4. Use a maintained iCalendar-generation library that correctly handles text escaping and line folding instead of constructing the document through string interpolation. 5. Add tests using malicious values containing `\r`, `\n`, commas, semicolons, and backslashes, and verify that no additional ICS property can be created. 6. Consider limiting the length of `address` and `notes` to reduce abuse and malformed calendar output.