T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:1417
- Finding
- Arbitrary JavaScript Evaluation Through Content Expressions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:1417-1440` **Vulnerability Type**: Dynamic code evaluation of content-controlled expressions **Risk Level**: High ### Vulnerable Code ```tsx function resolveValue(value, vars) { if (typeof value === 'string' && value.startsWith('$')) { return vars[value.slice(1)]; } if (typeof value === 'string' && value.includes('$')) { // 处理表达式如 "π*$R" // 安全替换：先替换变量，再替换数学常量 let expr = value .replace(/\$(\w+)/g, (_, name) => { const val = vars[name]; if (val === undefined) { console.warn(`⚠️ 未知变量: $${name}`); return 0; } return val; }) .replace(/π/g, 'Math.PI'); // 使用 Function 构造函数（比 eval 稍安全） try { const fn = new Function('return ' + expr); return fn(); } catch (e) { console.warn(`⚠️ 表达式解析失败: ${expr}`); return 0; } } return value; } ``` ### Technical Analysis The documented implementation builds JavaScript source code from values originating in `content.json` and evaluates it with the `Function` constructor. Variable substitution does not constrain the rest of the expression to arithmetic syntax. Any JavaScript syntax surrounding a `$variable` reference remains intact and is compiled. The `Function` constructor is not a safe alternative to `eval`; both provide dynamic code execution. The documentation incorrectly labels this implementation as safe, making it likely that generated projects will adopt the vulnerable pattern. The code executes in the Remotion Chromium rendering context. It does not, by itself, demonstrate direct operating-system shell execution, but it can execute arbitrary browser-context JavaScript with the capabilities available to rendered project code. ### Attack Path 1. An attacker supplies or modifies a project’s `scripts/content.json`, such as through a shared video template or imported content package. 2. The attacker places a JavaScript expre ...[truncated 1074 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove all use of `eval`, `new Function`, and equivalent dynamic JavaScript compilation. - Implement a strict arithmetic parser that accepts only: - Numeric literals. - Explicitly declared variable names. - Parentheses. - Approved arithmetic operators such as `+`, `-`, `*`, `/`, and exponentiation if required. - Explicit constants such as `PI`. - Tokenize the input and reject unknown identifiers, property access, brackets, quotes, semicolons, assignments, function calls, and other JavaScript syntax. - Prefer a small, well-maintained expression parser configured with an explicit allowlist. - Validate `content.json` against a schema before rendering. - Treat content and templates received from other users as untrusted. - Add negative tests proving that expressions containing function calls, global-object access, assignments, or statement separators are rejected. - Correct the documentation so that dynamic JavaScript evaluation is never described as safe. ]]>