T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/architecture_diagram_generator.py:245- Finding
Unescaped Project Metadata Permits Mermaid and PlantUML Diagram Injection
- Content
View full analysis
{file_count} files"]') # Mermaid external dependency labels if self.external_deps: lines.append('') lines.append(' subgraph External') for dep in list(self.external_deps)[:5]: safe_dep = self._safe_id(dep) lines.append(f' {safe_dep}(("{dep}"))') lines.append(' end') ``` ```python # PlantUML component labels for name, info in self.components.items(): file_count = info.get('files', 0) lines.append( f'component "{name}\\n({file_count} files)" as {self._safe_id(name)}' ) # PlantUML external dependency labels if self.external_deps: lines.append('') lines.append('package "External Dependencies" {') for dep in list(self.external_deps)[:5]: lines.append(f' [{dep}]') lines.append('}') ``` The identifier sanitizer does not protect the displayed labels: ```python def _safe_id(self, name: str) -> str: """Convert name to safe Mermaid ID.""" return re.sub(r'[^a-zA-Z0-9]', '_', name) ``` ### Technical Analysis The scanner obtains component names from top-level directory names and dependency names from project-controlled package manifests. These values are inserted directly into Mermaid and PlantUML source code. Although `_safe_id()` converts node identifiers to alphanumeric forms, the original `name` and `dep` values remain unescaped inside labels. Characters such as quotation marks, closing brackets, parentheses, newlines, and diagram directives can terminate the inte ...[truncated 2521 chars]- Remediation
View remediation