T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/json_to_md.py:17- Finding
Untrusted Markdown and HTML Injection in Generated Reports
- Content
View full analysis
") ``` The insufficiently escaped values are inserted into the generated report at the following locations: ```python parts = [f"# {title}", ""] ``` ```python parts.append(f"## {key}") ``` ```python for key, value in data.items(): parts.append(f"| {escape_cell(key)} | {escape_cell(value)} |") ``` ### Technical Analysis The `escape_cell()` function escapes only pipe characters and line-feed characters. It does not neutralize raw HTML, Markdown links, Markdown images, backticks, carriage returns, or other syntax interpreted by Markdown renderers. Moreover, the report title and headings derived from top-level JSON keys are inserted without calling `escape_cell()` or applying any context-appropriate encoding. An attacker who controls the input JSON or the `--title` argument can therefore place active or misleading Markdown content in the generated report. For example, the following input value is preserved as raw HTML: ```json { "status": "" } ``` The generated Markdown contains: ```markdown | status |
| ``` When opened in a Markdown renderer that permits raw HTML or remote images, this content may cause a request to an attacker-controlled server. Markdown links, images, headings, and other presentation elements can also be injected to create deceptive report content. ### Attack Path 1. An attacker supplies or influences a JSON file processed by the skill, or controls the value passed through `--title`. 2. The attacker embeds raw H ...[truncated 1521 chars]
- Remediation
View remediation
`, and `&` when HTML rendering is not explicitly required. 3. Normalize all line endings, including `\r\n`, standalone `\r`, and `\n`, before inserting content into a table or heading. 4. Use a dedicated Markdown-generation or sanitization library with a clearly defined safe-output policy where feasible. 5. Treat titles and headings separately from table cells because each Markdown context has different parsing rules. 6. If preserving arbitrary text exactly is required, render values using safely escaped code spans or fenced blocks while correctly handling embedded backticks and fence delimiters. 7. If generated reports are rendered to HTML, apply an HTML sanitizer and disable raw HTML and remote resource loading in the renderer. 8. Add regression tests for raw HTML, Markdown links and images, backticks, pipes, angle brackets, CR/LF combinations, heading syntax, and malicious title values. ]]>