T09 · Insecure Skill Coding Practices
Error
- Location
- data-format.md:527
- Finding
- Unsafe Dynamic Evaluation of Configurable Mathematical Expressions## Vulnerability Details **File Location**: `data-format.md:527` **Vulnerability Type**: Arbitrary JavaScript execution through an insufficient expression whitelist **Risk Level**: High ### Vulnerable Code Segment ```text curves[].expr new Function [0-9a-zA-Z_+\-*/(). ,Math] ``` The contract instructs generated pages to evaluate `curves[].expr` using `new Function` after checking it against the displayed character whitelist. Supporting requirements at lines 555 and 620 rely on the same whitelist as the primary expression-security control. ### Technical Analysis The whitelist permits every uppercase and lowercase letter, digits, periods, parentheses, commas, underscores, and arithmetic operators. It therefore does not restrict expressions to numeric literals, approved parameters, and specific `Math` methods. Dangerous global identifiers and method chains can satisfy this character policy. For example: ```js eval(location.hash.slice(1)) ``` Every character in this expression is permitted by the documented whitelist. When compiled with `new Function`, global browser objects and functions remain accessible unless the evaluator explicitly shadows or blocks them. HTML escaping does not mitigate this issue because the attack occurs in JavaScript expression evaluation rather than HTML parsing. This behavior conflicts with the Skill's stated security model, under which teacher-provided and retrieved content must remain inert data. ### Attack Path 1. An attacker places a malicious expression in teacher-supplied or retrieved content that is converted into `curves[].expr`. 2. The expression uses only characters accepted by the documented whitelist. 3. The generated interactive HTML embeds the expression in `PLOT_CONFIG`. 4. The page validates the expression using the insufficient character policy. 5. The rendering engine passes the expression to `new Function`. 6. The resulting function resolves accessible browser ...[truncated 921 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all use of `new Function`, `eval`, and equivalent dynamic JavaScript compilation. 2. Parse expressions with a dedicated mathematical grammar that supports only: - Finite numeric literals. - Explicitly declared parameter names. - The independent variable `x`. - Approved arithmetic operators. - An explicit list of mathematical functions such as `sin`, `cos`, `log`, and `sqrt`. 3. Evaluate the parsed abstract syntax tree with a custom interpreter rather than JavaScript execution. 4. Reject: - Unknown identifiers. - Arbitrary property access. - Computed properties. - Constructors and prototypes. - Assignment and sequence expressions. - Global browser objects and functions. 5. Validate parameter keys against a restrictive identifier pattern and reject names that collide with globals or reserved words. 6. Add negative security tests for payloads involving `eval`, `Function`, `constructor`, `location`, `document`, `window`, and chained property access. 7. Treat validation failure as a hard rendering failure and record only a generic diagnostic without evaluating the expression.