T09 · Insecure Skill Coding Practices
Error
- Location
md2img.mjs:609- Finding
Untrusted Markdown Is Rendered as Active HTML with Network Access in an Unsandboxed Browser
- Content
View full analysis
``` This creates a blind server-side re ...[truncated 2619 chars]
- Remediation
View remediation
{ const url = new URL(route.request().url()); if (url.protocol === 'about:' || url.protocol === 'data:') { return route.continue(); } return route.abort(); }); ``` 4. If remote images are a required feature: - Require an explicit option to enable them. - Permit only HTTPS. - Use an explicit hostname allowlist. - Resolve hostnames and reject loopback, private, link-local, multicast, and reserved addresses. - Revalidate destinations after redirects and DNS resolution. - Apply response-size and download-time limits. 5. Remove `--no-sandbox` and `--disable-setuid-sandbox` wherever the deployment environment supports Chromium sandboxing. 6. Apply resource limits: - Maximum Markdown input size. - Maximum rendered page height. - Maximum number of embedded resources. - Strict navigation and request timeouts. - Browser process memory and CPU limits. 7. Add security tests using Markdown containing scripts, event handlers, localhost images, private-network URLs, and cloud metadata URLs. Confirm that scripts do not execute and network requests are blocked. ]]>