T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/search_openclaw_news.py:305
- Finding
- Unsanitized search-result fields allow Markdown and HTML content injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/search_openclaw_news.py:305-310` **Vulnerability Type**: Untrusted content injection into generated Markdown **Risk Level**: Medium ### Vulnerable Code ```python report += f"{i}. **{item['title']}**\n" report += f" - **来源**：{item['source']}\n" report += f" - **风险等级**：{risk_level}\n" report += f" - **摘要**：{item['content']}\n" if item.get('url'): report += f" - **链接**：{item['url']}\n" ``` ### Technical Analysis The report generator inserts the `title`, `source`, `content`, and `url` fields directly into Markdown without escaping Markdown metacharacters, removing raw HTML, validating URL schemes, or filtering control characters. These fields originate from externally supplied search results. An attacker who controls indexed web content can place crafted Markdown or HTML in an article title, source name, summary, or URL. The injected content can terminate the intended formatting and introduce forged headings, links, images, recommendations, or raw HTML elements. Content length truncation performed earlier in the processing pipeline does not provide sanitization. It does not prevent malicious syntax from appearing within the retained portion. ### Attack Path 1. An attacker publishes content designed to appear in OpenClaw-related search results. 2. The attacker places crafted Markdown or HTML in the page title or summary, such as a deceptive security alert or phishing link. 3. The host agent retrieves the page and supplies its fields to `format_search_results()`. 4. The resulting item is passed to `generate_daily_report_content()`. 5. Lines 305-310 interpolate the attacker-controlled fields directly into the report. 6. The report is displayed in a Markdown-capable conversation interface. 7. The malicious content alters the report presentation or directs the user to an attacker-controlled destination. If the consuming renderer permits unsafe HTML or URL schemes, the effect may extend to ...[truncated 723 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Escape Markdown metacharacters in all untrusted text fields, including backslashes, brackets, parentheses, asterisks, underscores, backticks, hash characters, and angle brackets. 2. Remove or encode raw HTML before constructing the report. 3. Parse URLs with a standard URL parser and allow only explicitly approved schemes, preferably `https` and, if required, `http`. 4. Reject dangerous or ambiguous schemes such as `javascript`, `data`, `file`, and custom application schemes. 5. Build links through a dedicated safe-link function instead of inserting raw URL strings. 6. Remove control characters and normalize Unicode before rendering. 7. Apply strict length limits to titles, sources, summaries, and URLs. 8. Label retrieved material as untrusted external content and ensure that it is never interpreted as agent instructions. 9. Add tests using malicious titles, summaries, and URLs containing Markdown links, headings, raw HTML, multiline text, and dangerous URL schemes. ]]>