T09 · Insecure Skill Coding Practices
Error
- Location
eval-viewer/generate_review.py:143- Finding
Stored Script Injection Through Unescaped Evaluation Output
- Content
View full analysis
dict: """Read a file and return an embedded representation.""" ext = path.suffix.lower() mime = get_mime_type(path) if ext in TEXT_EXTENSIONS: try: content = path.read_text(errors="replace") except OSError: content = "(读取文件失败)" return { "name": path.name, "type": "text", "content": content, } ``` ```python embedded = { "skill_name": skill_name, "runs": runs, "previous_feedback": previous_feedback, "previous_outputs": previous_outputs, } if benchmark: embedded["benchmark"] = benchmark data_json = json.dumps(embedded) return template.replace( "/*__EMBEDDED_DATA__*/", f"const EMBEDDED_DATA = {data_json};", ) ``` The generated data is inserted into this executable context: ```html `. A malicious output containing a payload such as: ```html ``` can terminate the original script element before JavaScript parsing and create a new attacker-controlled script element. ...[truncated 1877 chars]- Remediation
View remediation
SAFE_SERIALIZED_DATA ``` ```javascript const EMBEDDED_DATA = JSON.parse( document.getElementById("embedded-data").textContent ); ``` 3. Before embedding JSON in HTML, escape at least the following characters: - `<` as `\u003c` - `>` as `\u003e` - `&` as `\u0026` - U+2028 as `\u2028` - U+2029 as `\u2029` 4. Prefer a tested HTML-safe JSON serialization function rather than an ad hoc replacement. 5. Add a restrictive Content Security Policy. For example, use separate JavaScript files and a policy that avoids `unsafe-inline`, restricts `connect-src`, and permits only explicitly required resources. 6. Avoid loading unnecessary third-party resources in a page containing potentially sensitive evaluation data. 7. Add regression tests using payloads containing ``, nested script tags, HTML event handlers, and Unicode line separators. ]]>