T09 · Insecure Skill Coding Practices
Error
- Location
eval-viewer/generate_review.py:149- Finding
Stored Script Injection Through Embedded Evaluation Outputs
- Content
View full analysis
dict: """Read a file and return an embedded representation.""" ext = path.suffix.lower() mime = get_mime_type(path) if ext in TEXT_EXTENSIONS: try: content = path.read_text(errors="replace") except OSError: content = "(Error reading file)" return { "name": path.name, "type": "text", "content": content, } elif ext in IMAGE_EXTENSIONS: try: raw = path.read_bytes() b64 = base64.b64encode(raw).decode("ascii") except OSError: return {"name": path.name, "type": "error", "content": "(Error reading file)"} return { "name": path.name, "type": "image", "mime": mime, "data_uri": f"data:{mime};base64,{b64}", } elif ext == ".pdf": try: raw = path.read_bytes() b64 = base64.b64encode(raw).decode("ascii") except OSError: return {"name": path.name, "type": "error", "content": "(Error reading file)"} return { "name": path.name, "type": "pdf", "data_uri": f"data:{mime};base64,{b64}", } elif ext == ".xlsx": try: raw = path.read_bytes() b64 = base64.b64encode(raw).decode("ascii") except OSError: return {"name": path.name, "type": "error", "content": "(Error reading file)"} return { "name": path.name, "type": "xlsx", "data_b64": b64, } else: # Binary / unknown — base64 download link try: raw = path.read_bytes() b ...[truncated 3302 chars]- Remediation
View remediation
SAFE_JSON_DATA ``` 3. Before embedding JSON into HTML, encode HTML-significant characters, at minimum: ```python data_json = json.dumps(embedded) data_json = ( data_json .replace("<", "\\u003c") .replace(">", "\\u003e") .replace("&", "\\u0026") ) ``` 4. Parse the non-executable element at runtime: ```javascript const EMBEDDED_DATA = JSON.parse( document.getElementById("embedded-data").textContent ); ``` 5. Add a restrictive Content Security Policy that disallows arbitrary inline scripts and limits outbound connections, for example by using a nonce-bearing local script and `connect-src 'self'`. 6. Prefer serving downloadable output files through validated local endpoints instead of embedding every file into the page. 7. Add regression tests using payloads containing ``, mixed-case ``, HTML comments, Unicode separators, and malicious SVG/HTML content. ]]>