T09 · Insecure Skill Coding Practices
Error
- Location
scripts/send_via_cdp.js:262- Finding
Recipient and Subject Validation Can Produce False Positives Before Sending
- Content
View full analysis
(e.getAttribute('email') || '').toLowerCase()); const toValue = (toEl?.value || '').toLowerCase(); const toOk = toValue.includes(to.toLowerCase()) || recipientTokens.includes(to.toLowerCase()) || text.toLowerCase().includes(to.toLowerCase()); const subjectValue = (subEl?.value || '').trim(); const subjectOk = subjectValue.length > 0; const attachmentMatches = requestedFiles.map((name) => ({ name, present: text.includes(name), })); const attachmentOk = attachmentMatches.every((item) => item.present); return { toOk, subjectOk, attachmentOk, attachmentMatches, subjectValue }; }, to, bases); if (!checks.toOk || !checks.subjectOk || !checks.attachmentOk) { throw new Error(`Validation failed: ${JSON.stringify(checks)}`); } ``` ### Technical Analysis The intended recipient is considered valid when its string appears anywhere in the compose dialog. In particular, the following fallback is unsafe: ```javascript text.toLowerCase().includes(to.toLowerCase()) ``` The dialog text includes more than the actual recipient field. It may include the message body, quoted content, attachment metadata, autocomplete content, or unrelated interface text. Consequently, an intended address appearing in the body can make `toOk` true even when the actual recipient chip contains a different address. The check against `toValue` als ...[truncated 1732 chars]- Remediation
View remediation