T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/browser-session-manager.js:94
- Finding
- Arbitrary-Origin Injection of Sensitive Browser Storage<![CDATA[ ## Vulnerability Details **File Location**: `scripts/browser-session-manager.js`, lines 94-123 and 194-205 **Vulnerability Type**: Sensitive authentication-state exposure through missing origin validation **Risk Level**: High ### Vulnerable Code ```javascript // Navigate to target URL console.log(`🔗 访问目标页面: ${url}`); await page.goto(url, { waitUntil: 'networkidle', timeout: 60000 }); // Apply localStorage if present if (sessionData.localStorage && Object.keys(sessionData.localStorage).length > 0) { console.log(`💾 设置 ${Object.keys(sessionData.localStorage).length} 个 localStorage 项...`); await page.evaluate((data) => { for (const [key, value] of Object.entries(data)) { try { localStorage.setItem(key, value); } catch (e) { console.error(`设置 localStorage[${key}] 失败:`, e); } } }, sessionData.localStorage); } // Apply sessionStorage if present if (sessionData.sessionStorage && Object.keys(sessionData.sessionStorage).length > 0) { console.log(`📦 设置 ${Object.keys(sessionData.sessionStorage).length} 个 sessionStorage 项...`); await page.evaluate((data) => { for (const [key, value] of Object.entries(data)) { try { sessionStorage.setItem(key, value); } catch (e) { console.error(`设置 sessionStorage[${key}] 失败:`, e); } } }, sessionData.sessionStorage); } ``` The target is taken directly from the command line: ```javascript const [url, sessionJsonPath, screenshotPath] = args; applySessionData(url, sessionJsonPath, { screenshotPath }) ``` ### Technical Analysis The session manager accepts an unrestricted target URL, navigates to that URL, and writes every supplied `localStorage` and `sessionStorage` value into the active origin. Web Storage is scoped to the currently loaded origin. Consequently, if the caller supplies an attacker-controlled URL, sensitive values from a Jimeng session export are not restored to Jimeng. Instead, they are inserted into the attacker' ...[truncated 1948 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse and validate the destination before launching the browser: - Require `https:`. - Allow only `jimeng.jianying.com`, or an explicitly documented set of trusted subdomains. - Reject embedded credentials, nonstandard schemes, and unexpected ports. 2. Compare the destination against trusted metadata from the session export: ```javascript const target = new URL(url); const exported = new URL(sessionData.url); if (target.protocol !== 'https:' || target.origin !== exported.origin) { throw new Error('Session data cannot be restored to a different origin'); } ``` 3. Treat cross-origin restoration as prohibited by default. If it is genuinely required, require a separate explicit option and interactive confirmation. 4. Use an allowlist for storage keys instead of restoring the entire exported object. 5. Avoid restoring authentication tokens unless they are essential to the requested operation. 6. Validate the final origin after navigation and redirects before writing storage: ```javascript await page.goto(url, options); if (new URL(page.url()).origin !== expectedOrigin) { throw new Error('Navigation redirected outside the trusted origin'); } ``` 7. Clear the browser context and abort immediately if an origin mismatch is detected. ]]>