T09 · Insecure Skill Coding Practices
Error
- Location
scripts/browser-session-manager.js:94- Finding
Arbitrary-Origin Injection of Sensitive Browser Storage
- Content
View full analysis
0) { console.log(`💾 设置 ${Object.keys(sessionData.localStorage).length} 个 localStorage 项...`); await page.evaluate((data) => { for (const [key, value] of Object.entries(data)) { try { localStorage.setItem(key, value); } catch (e) { console.error(`设置 localStorage[${key}] 失败:`, e); } } }, sessionData.localStorage); } // Apply sessionStorage if present if (sessionData.sessionStorage && Object.keys(sessionData.sessionStorage).length > 0) { console.log(`📦 设置 ${Object.keys(sessionData.sessionStorage).length} 个 sessionStorage 项...`); await page.evaluate((data) => { for (const [key, value] of Object.entries(data)) { try { sessionStorage.setItem(key, value); } catch (e) { console.error(`设置 sessionStorage[${key}] 失败:`, e); } } }, sessionData.sessionStorage); } ``` The target is taken directly from the command line: ```javascript const [url, sessionJsonPath, screenshotPath] = args; applySessionData(url, sessionJsonPath, { screenshotPath }) ``` ### Technical Analysis The session manager accepts an unrestricted target URL, navigates to that URL, and writes every supplied `localStorage` and `sessionStorage` value into the active origin. Web Storage is scoped to the currently loaded origin. Consequently, if the caller supplies an attacker-controlled URL, sensitive values from a Jimeng session export are not restored to Jimeng. Instead, they are inserted into the attacker' ...[truncated 1948 chars]- Remediation
View remediation