T09 · Insecure Skill Coding Practices
- Location
handler.js:4- Finding
Unvalidated AI-Generated Values Allow CSS Injection
- Content
View full analysis
Vulnerability Details
File Location:
handler.js:4-15andhandler.js:75-79
Vulnerability Type: Unvalidated model output and unsafe CSS generation
Risk Level: MediumThe following formatter inserts AI-generated values directly into CSS declarations without validating their types or permitted syntax:
js function toCSS(theme) { const vars = Object.entries({ '--primary-color': theme.primaryColor, '--secondary-color': theme.secondaryColor, '--accent-color': theme.accentColor, '--background-color': theme.backgroundColor, '--font-stack': theme.fontStack, }) .map(([k, v]) => ` ${k}: ${v};`) .join('\n'); return `:root {\n${vars}\n}`; }The untrusted model response is parsed and passed directly to the selected formatter:
js const data = await response.json(); const text = data.choices?.[0]?.message?.content ?? ''; const theme = JSON.parse(text); const formatter = FORMATTERS[format] ?? FORMATTERS.css; return formatter(theme);Technical Analysis
The application treats an external language model's response as trusted structured data.
JSON.parseconfirms only that the response is syntactically valid JSON; it does not enforce a schema, primitive value types, required properties, valid color syntax, or safe font-family syntax.In CSS mode, each returned value is interpolated verbatim into a declaration. A malicious or prompt-manipulated response could include declaration terminators, braces, comments, additional selectors, or constructs such as
url(...). For example, a value containingred; } body { display: nonewould escape the intended custom-property declaration and add an unintended CSS rule.Tailwind and VS Code output is protected from direct JSON syntax injection by
JSON.stringify, but the values remain semantically unvalidated and may become unsafe if downstream tooling interprets them as CSS or configuration values. Malfo ...[truncated 1613 chars]- Remediation
View remediation
Remediation Suggestions
- Define and enforce a strict response schema requiring exactly
primaryColor,secondaryColor,accentColor,backgroundColor, andfontStackas strings. - Validate color fields against a narrow allowlist of supported formats, such as normalized six-digit hexadecimal colors, rather than accepting arbitrary CSS values.
- Replace free-form
fontStackoutput with an allowlisted identifier mapped internally to a predefined font stack. - Reject values containing declaration terminators, braces, comments, control characters, line breaks,
url(),var(), or other unsupported CSS constructs. - Prefer structured model output or JSON-schema response enforcement when supported by the provider, while retaining local validation because model-side enforcement is not a security boundary.
- Check
response.ok, validate the provider response shape, and handle JSON parsing and schema failures with a controlled error. - Add adversarial tests covering prompt injection, missing properties, non-string values, semicolons, braces, comments, external URLs, oversized responses, and malformed JSON.
- Define and enforce a strict response schema requiring exactly