T09 · Insecure Skill Coding Practices
Error
- Location
scripts/jtest_generator.py:174- Finding
Generated Java Source Injection Through Unescaped JSON Fields
- Content
View full analysis
requestBody = new HashMap<>();"] for key, value in body.items(): if value is None: lines.append(f" requestBody.put(\"{key}\", null);") elif isinstance(value, str): lines.append(f" requestBody.put(\"{key}\", \"{value}\");") elif isinstance(value, bool): lines.append(f" requestBody.put(\"{key}\", {str(value).lower()});") elif isinstance(value, (int, float)): lines.append(f" requestBody.put(\"{key}\", {value});") elif isinstance(value, dict): import json dict_str = json.dumps(value, ensure_ascii=False).replace('"', '\\"') lines.append(f" requestBody.put(\"{key}\", \"{dict_str}\");") elif isinstance(value, list): import json list_str = json.dumps(value, ensure_ascii=False).replace('"', '\\"') lines.append(f" requestBody.put(\"{key}\", \"{list_str}\");") ``` Additional affected generation sinks include: ```python lines.append(f" .andExpect(jsonPath(\"{json_path}\").value(\"{value}\"))") ``` ```python f" logger.info(\"Executing test: {test_case.id} - {test_case.name}\");", ``` ```python lines.append(f" mockMvc.perform(post(\"{endpoint}\")") ``` ### Technical Analysis The generator interpolates JSON-controlled request keys, string values, expected response values, test identifiers, test names, and endpoint values directly into Java source code. It does not consistently encode these values as Java string literals. For example, a string value containing a double quote, Java statement terminator, and comment marker can close the intended string and inject a new Java statement. Escaping only quotation marks in selected fields is also insufficient because ...[truncated 2213 chars]- Remediation
View remediation