T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/export_testcases.py:140- Finding
Unescaped Test-Case Data in TestLink XML Export
- Content
View full analysis
') xml_lines.append(f' ')xml_lines.append(f' ') for i, step in enumerate(steps.split('\n'), 1): xml_lines.append(f' <step_number></step_number>1') xml_lines.append(f' ') xml_lines.append(f' ')
text ### Technical Analysis The TestLink exporter constructs XML by directly interpolating test-case fields into XML attributes and CDATA sections. These fields originate from JSON supplied through standard input and are not escaped or validated. The `tc_id` and `title` values are inserted into the `name` attribute without XML attribute escaping. A quotation mark can terminate the attribute and allow injection of additional attributes or elements. The `precondition`, `step`, and `expected` values are inserted into CDATA sections without handling the CDATA terminator `]]>`. An attacker can therefore close the CDATA section and inject arbitrary XML markup. For example, a malicious title could contain: ```text malicious" injected="trueA malicious step could contain:
text ]]></actions></step><testcase name="Injected"><steps><![CDATA[This can produce malformed XML or attacker-controlled elements in the exported document.
Attack Path
- An attacker supplies or influences requirement content or generated test-case JSON.
- The resulting test case contains quotation marks or
]]>sequences in a title, precondition, step, or expected result. - A user invokes the TestLink export function ...[truncated 885 chars]
- Remediation
View remediation
`.- Validate every test-case record before serialization:
- Require the expected number of fields.
- Require string values for textual fields.
- Apply reasonable field-length limits.
- Parse the completed output with a secure XML parser before writing or returning it to confirm that it is well formed.
- Add regression tests covering quotation marks, angle brackets, ampersands, and
]]>in every exported field.
A safer implementation should resemble:
python import xml.etree.ElementTree as ET testcase = ET.SubElement( testsuite, "testcase", { "name": f"{tc_id} {title}", "importance": priority_map.get(priority, "3"), "exec_order": "1", }, ) ET.SubElement(testcase, "preconditions").text = precondition]]>
- Validate every test-case record before serialization: