T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/show_history.py:260- Finding
Stored HTML Injection in Playback History Export
- Content
View full analysis
{i}{t}{g}{d}{nm}{u}{no}".format( i=i, t=h["Time"], g=h["Genre"], d=dur, nm=h["Name"], u=url, no=note ) ) ``` ### Technical Analysis The HTML export function inserts playback-history values directly into an HTML document without HTML escaping. Dynamic fields include the stream name, genre, URL, note, time, and duration. Some of these values originate from the companion stream database and are persisted in `state.json` when a stream is played. If an attacker can introduce malicious stream metadata, a value such as: ```html``` would be written into the generated HTML as active markup rather than text. Opening the exported document in a browser could therefore execute attacker-controlled JavaScript. This is a stored injection vulnerability because the malicious metadata is first saved in playback history and subsequently rendered by the export function. ### Attack Path 1. An attacker introduces a stream record containing malicious HTML or JavaScript in a metadata field such as `name`, `genre`, or `url`. 2. The companion database marks the stream as available. 3. The user plays the stream, causing its metadata to be copied into the local playback history. 4. The user runs `show_history.py --export html`, optionally specifying an output file. 5. The export function interpolates the malicious value into the HTML document without escaping it. 6. The user opens the exported file in a browser. 7. The browser interprets the injected valu ...[truncated 656 chars]
- Remediation
View remediation
{i}{t}{g}{d}" "{nm}{u}{no}".format( i=i, t=timestamp, g=genre, d=dur, nm=name, u=url, no=note, ) ) ``` Additional hardening measures: - Prefer an HTML template engine with automatic escaping enabled. - Treat all stream-database and history values as untrusted, even when loaded from local files. - If URLs are later rendered as links, separately validate their schemes and construct attributes using quoted, escaped values. - Add regression tests using payloads containing tags, quotes, ampersands, and event handlers. - Consider adding a restrictive Content Security Policy to exported documents as defense in depth, while retaining output escaping as the primary control. ]]>