T09 · Insecure Skill Coding Practices
Error
- Location
skills/weapp-automated-testing/scripts/weapp_automation.py:126- Finding
Arbitrary JavaScript Execution Through Unsafely Interpolated WebSocket Endpoint
- Content
View full analysis
str: ws_endpoint = self.config.ws_endpoint if hasattr(self.config, 'ws_endpoint') else 'ws://localhost:9420' base_script = ''' const automator = require('miniprogram-automator'); async function runTest() { const miniProgram = await automator.connect({ wsEndpoint: '%%WS_ENDPOINT%%' }); // ... } ''' # ... return base_script.replace('%%WS_ENDPOINT%%', ws_endpoint) % "".join(js_code) ``` The same unsafe construction occurs in the console and performance utilities: ```python ws_endpoint = self.ws_endpoint script_content = f''' const automator = require('miniprogram-automator'); async function getLogs() {{ try {{ const miniProgram = await automator.connect({{ wsEndpoint: '{ws_endpoint}' }}); // ... }} catch (error) {{ // ... }} }} ''' ``` ### Technical Analysis The configurable `ws_endpoint` value is inserted directly into a JavaScript single-quoted string. It is not encoded as a JavaScript string literal, escaped, or constrained to an expected URL format. The generated source is written to a temporary `.js` file and executed with Node.js: ```python result = subprocess.run( ["node", script_path], capture_output=True, text=True, timeout=30 ) ``` A malicious endpoint containing a quote followed by JavaScript statements can terminate the intended string and introduce arbitrary JavaScript. Because Node.js exposes filesystem, process, and child-process APIs, successful injection can become arbitrary command execution under the account running the Skill. This ope ...[truncated 1307 chars]- Remediation
View remediation