T09 · Insecure Skill Coding Practices
Warning
- Location
assets/report-template.html:5- Finding
Unsanitized Report Content Allows HTML and JavaScript Injection
- Content
View full analysis
{report_title} ``` ```html {check_type} {check_location} {check_time} {check_personnel} {check_object} ``` ```html{check_overview}
``` ```html {problems_section} ``` ```html {rectification_section} ``` ```html{conclusion_text}
``` The instructions in `SKILL.md:57-59` direct the agent to read this template and replace all template variables when assembling the report. They do not require escaping or sanitizing collected report content. ### Technical Analysis Inspection details supplied by users are placed into HTML text and document-body contexts. The generation process does not define any HTML encoding, sanitization allowlist, URL validation, or Content Security Policy. An attacker who controls an inspection field can therefore supply HTML instead of plain text. For example, a value containing an element with an event handler could execute JavaScript when the generated report is opened: ```html``` The title placeholder is also vulnerable to context breakout using a value beginning with ``. The `problems_section` and `rectification_section` placeholders intentionally accept complete HTML fragments but impose no restrictions on elements, attributes, URL schemes, embedded frames, scripts, or event handlers. Because the generated artifact is a standalone HTML file, injected active content is interpreted by the recipient's browser ...[truncated 1459 chars]
- Remediation
View remediation
`, `"`, and `'`. - Do not perform unrestricted string replacement with raw user values. 2. **Safely generate structured sections** - Construct problem and rectification sections through a template engine with automatic escaping enabled. - Keep text values separate from trusted markup. - Avoid accepting complete user-controlled HTML fragments. 3. **Sanitize any intentionally supported rich text** - Use a maintained HTML sanitizer with a strict allowlist. - Permit only necessary formatting elements and attributes. - Reject `script`, `iframe`, `object`, `embed`, `svg`, `math`, form controls, event-handler attributes, and dangerous URL schemes such as `javascript:`. - Restrict images to the expected `data:image/jpeg;base64,...` format generated by the image-processing script. 4. **Add a restrictive Content Security Policy** - Add a policy similar to: ```html ``` - Avoid enabling inline scripts or network connections. 5. **Validate generated output** - Scan the completed document before delivery for scripts, event-handler attributes, remote URLs, embedded frames, and unresolved placeholders. - Add tests using payloads that attempt text-context and title-context breakouts. 6. **Document the trust boundary** - Update `SKILL.md` to explicitly require escaping plain-text fields and sanitizing structured HTML before substitution. ]]>