T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/skill_chatbot.py:311
- Finding
- Stored DOM-Based Cross-Site Scripting in Web Search Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/skill_chatbot.py:311-337` **Vulnerability Type**: Stored DOM-based cross-site scripting caused by unsafe HTML construction **Risk Level**: Medium ### Vulnerable Code ```javascript data.results.forEach(function(func) { html += `<div class="result">`; html += `<h3>${func.name} <span class="category">${func.category}</span></h3>`; html += `<p class="description"><strong>描述:</strong> ${func.description}</p>`; html += `<div class="syntax"><strong>语法:</strong> ${func.syntax}</div>`; if (func.parameters.length > 0) { html += `<div class="parameters"><strong>参数:</strong><ul>`; func.parameters.forEach(function(p) { const required = p.required ? '必填' : '可选'; html += `<li class="param">${p.name}: ${p.description} (${p.type}, ${required})</li>`; }); html += `</ul></div>`; } html += `<p><strong>返回类型:</strong> ${func.return_type}</p>`; if (func.example) { html += `<div class="example"><strong>示例:</strong>\n${func.example}</div>`; } if (func.notes) { html += `<p class="notes"><strong>注意:</strong> ${func.notes}</p>`; } html += `</div>`; }); document.getElementById('results').innerHTML = html; ``` ### Technical Analysis The browser interpolates API database fields directly into an HTML string and assigns the result to `innerHTML`. No contextual output encoding or HTML sanitization is applied to fields such as `name`, `category`, `description`, `syntax`, parameter properties, `return_type`, `example`, or `notes`. These fields originate from a JSON database loaded by the server. The command-line interface permits the operator to select a database using `--db`, so the database cannot always be treated as trusted. An attacker-controlled value such as an image element with an `onerror` handler would be parsed as active HTML when a matching search result is displayed. The ...[truncated 1539 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not construct result markup by interpolating database values into HTML strings. 2. Create DOM nodes with `document.createElement()` and assign all database-derived values through `textContent`. 3. If formatted HTML is an explicit requirement, sanitize every untrusted field with a maintained allowlist-based HTML sanitizer before insertion. 4. Validate loaded JSON against a strict schema, including expected types, field lengths, and permitted structures. 5. Treat all custom `--db` input as untrusted, even when the database is stored locally. 6. Add a restrictive Content Security Policy that disallows inline scripts and event handlers as a defense-in-depth measure. 7. Add regression tests containing payloads in every displayed database field and confirm they are rendered as literal text rather than executable markup. ]]>