T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:373- Finding
Generated Quiz HTML Uses Unsafe innerHTML With Untrusted Educational Content
- Content
View full analysis
Correct'; correct++; } else { feedback.innerHTML = 'Incorrect Correct answer: ' + answer + '' + explanations[qName] + ''; } ``` ### Technical Analysis The quiz template assigns an HTML string to `feedback.innerHTML`. That string contains the dynamically generated values `answer` and `explanations[qName]` without HTML sanitization or contextual output encoding. Quiz explanations are generated from uploaded textbooks, PDFs, web search results, topic descriptions, and personalized user input. These sources may be attacker-controlled. If malicious markup reaches an explanation or answer, the browser parses it as active HTML when the learner submits the quiz. For example, an attacker-controlled source could cause an explanation to contain a payload similar to: ```html``` When inserted through `innerHTML`, the element's event handler can execute JavaScript. The template also specifies no Content Security Policy that would mitigate inline event-handler execution. Embedding generated content into the JavaScript `explanations` object may introduce an additional script-context injection hazard if the generator does not safely serialize quotation marks, backslashes, newlines, and closing `` sequences. The provided template does not define a safe serialization or sanitization requirement. ### Attack Path 1. An attacker supplies or influences a textbook, PDF, web page, topic description, or other so ...[truncated 1517 chars]
- Remediation
View remediation
` sequences or place the serialized data in a non-executable JSON block and parse it safely. 3. Treat all textbook, PDF, search-result, and user-provided content as untrusted. Add an explicit generation rule prohibiting direct placement of source content into HTML, JavaScript, CSS, URLs, or event-handler attributes without contextual encoding. 4. If limited rich text is required, sanitize it with a maintained allowlist-based HTML sanitizer. Permit only necessary formatting elements and reject scripts, event-handler attributes, dangerous URL schemes, SVG, MathML, embedded objects, and frames. 5. Add a restrictive Content Security Policy to generated quizzes. Prefer external or nonce-authorized scripts and prohibit inline handlers. A baseline should include directives such as: ```html