T09 · Insecure Skill Coding Practices
Error
- Location
scripts/publish.sh:248- Finding
JavaScript Injection Through Untrusted OG Placeholder Values
- Content
View full analysis
- Remediation
View remediation
prepareOGPlaceholder(url)", url) ``` Apply additional input validation before using the value: ```python from urllib.parse import urlparse def validate_og_url(value): parsed = urlparse(value) if parsed.scheme not in ("http", "https") or not parsed.hostname: fail(f"invalid OG URL: {value}") if parsed.username or parsed.password: fail("credentials are not permitted in OG URLs") return value ``` Recommended hardening measures: 1. Treat all body HTML and placeholder attributes as untrusted input. 2. Never interpolate external values into JavaScript source strings. 3. Use Playwright’s structured argument serialization for every dynamic value. 4. Restrict placeholders to absolute `http` or `https` URLs. 5. Optionally enforce an allowlist of domains appropriate for the publishing workflow. 6. Add regression tests containing quotes, backslashes, line separators, and JavaScript-like placeholder values. 7. Reject malformed placeholders before any browser-side evaluation occurs. ]]>