T09 · Insecure Skill Coding Practices
Warning
- Location
publish.js:222- Finding
Unescaped HTML Injection into an Authenticated Browser Page
- Content
View full analysis
`${line || ''}
`).join(''); const bodySet = await page.evaluate((html) => { const el = document.querySelector('[contenteditable="true"]'); if (!el) return false; el.innerHTML = html; el.dispatchEvent(new Event('input', { bubbles: true })); return true; }, bodyHtml); ``` ### Technical Analysis The post body and hashtags originate from command-line arguments or a user-selected body file. These values are interpolated directly into HTML markup and assigned to the editor's `innerHTML` property without escaping or sanitization. An attacker able to influence the body or hashtag content can inject arbitrary HTML elements and attributes. Although scripts inserted directly through `innerHTML` are generally not executed as ordinary script elements, active attributes and elements—such as event-handler attributes—may execute when their associated events occur. The injection happens inside an already authenticated Xiaohongshu Creator page. Consequently, executable injected content would run in the context of that page rather than in an isolated preview document. ### Attack Path 1. An attacker supplies or persuades a user to use a malicious `--body`, `--body-file`, or `--hashtags` value. 2. The script appends the attacker-controlled content to `fullBody`. 3. Line 222 embeds the content into paragraph markup without HTML escaping. 4. Lines 226-229 assign the resulting markup to the authenticated page using `innerHTML`. 5. If the injected markup includes an active element or event-handler attribute and the relevant event is triggered, attacker-controlled JavaScript may execute in the page context. 6. That code may interact with the authenticated creator interface and initiate requests pe ...[truncated 850 chars]- Remediation
View remediation