T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/browser_agent.py:260
- Finding
- JavaScript Injection Through Unsafely Interpolated Inputs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/browser_agent.py`, lines 260–371 **Vulnerability Type**: JavaScript injection through string interpolation **Risk Level**: High ### Vulnerable Code ```python links = await self.page.evaluate(f''' () => {{ const pattern = "{text_pattern}".toLowerCase(); return Array.from(document.querySelectorAll('a')) .filter(a => a.innerText.toLowerCase().includes(pattern)) .map(a => ({{ text: a.innerText.trim(), href: a.href, selector: Array.from(a.classList).map(c => '.' + c).join('') || (a.id ? '#' + a.id : '') || a.tagName.toLowerCase() }})); }} ''') ``` ```python results = await self.page.evaluate(f''' () => {{ const walker = document.createTreeWalker( document.body, NodeFilter.SHOW_TEXT, null, false ); const matches = []; const keyword = "{keyword}"; let node; while (node = walker.nextNode()) {{ if (node.textContent.toLowerCase().includes(keyword.toLowerCase())) {{ const element = node.parentElement; const rect = element.getBoundingClientRect(); matches.push({{ text: node.textContent.trim(), tagName: element.tagName, className: element.className, id: element.id, href: element.href || null, position: {{ top: rect.top, left: rect.left, width: rect.width, height: rect.height }} }}); }} }} return matches.slice(0, 20); }} ''') ``` ```python if element_info.get('id'): await self.page.evaluate(f''' const e ...[truncated 2710 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Do not construct JavaScript programs using untrusted string interpolation. 1. Pass data as a separate Playwright evaluation argument: ```python links = await self.page.evaluate( """ (pattern) => Array.from(document.querySelectorAll('a')) .filter(a => a.innerText.toLowerCase().includes(pattern.toLowerCase())) .map(a => ({ text: a.innerText.trim(), href: a.href })) """, text_pattern, ) ``` 2. Apply the same argument-passing pattern to keywords and element metadata. 3. Prefer Playwright locators, such as `get_by_text()`, `locator()`, and locator-based styling, instead of custom JavaScript. 4. If selector construction is unavoidable, validate expected formats and use standards-compliant CSS escaping. 5. Add regression tests containing quotes, backslashes, newlines, template-literal characters, and attempted JavaScript payloads. ]]>