T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/html-to-image.js:311
- Finding
- Untrusted HTML Executes in Chromium with Browser Sandboxing Disabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/html-to-image.js`, lines 311-314; execution sinks at lines 332-334 and 384-385 **Vulnerability Type**: Unsafe active-content rendering with disabled browser isolation **Risk Level**: High ### Vulnerable Code ```javascript const browser = await puppeteer.launch({ headless: true, args: ['--no-sandbox', '--disable-setuid-sandbox'] }); ``` The caller-controlled HTML is rendered during both measurement and final image generation: ```javascript await page.setContent(measurementHtml, { waitUntil: 'domcontentloaded', timeout: options.timeout }); ``` ```javascript await page.setContent(htmlContent, { waitUntil: 'domcontentloaded', timeout: options.timeout }); ``` ### Technical Analysis The script reads an HTML file selected by the caller and loads it into a real Chromium page using `page.setContent()`. This operation permits active HTML content, including inline JavaScript, event handlers, frames, and network-capable elements, to execute. The browser is launched with both `--no-sandbox` and `--disable-setuid-sandbox`. These flags disable Chromium's primary process-isolation boundary. The implementation also does not: - Sanitize the supplied HTML. - Disable JavaScript. - Apply a restrictive Content Security Policy. - Intercept and restrict outbound browser requests. - Restrict access to private or loopback network destinations. - Place the renderer in a dedicated operating-system sandbox or container. Consequently, malicious HTML can perform browser-originated network requests during conversion. It may probe services reachable from the host, transmit information embedded in the document, or interact with inadequately protected internal HTTP services. If an attacker can additionally exploit a vulnerability in the installed Chromium version, disabling the browser sandbox significantly increases the potential host impact. ### Attack Path 1. An attacker supplies malicious text or Markdown ...[truncated 1621 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `--no-sandbox` and `--disable-setuid-sandbox`, and run Chromium as a non-root user in an environment that supports its normal sandbox. 2. Treat every input HTML document as untrusted. Sanitize it with an allowlist-based HTML sanitizer before rendering. 3. Disable JavaScript with `page.setJavaScriptEnabled(false)` if Markmap output can be rendered without runtime scripts. If JavaScript is required, generate the SVG in a trusted stage and render only inert output. 4. Use Puppeteer request interception to block all external requests by default. Allow only explicitly required local resources and reject loopback, link-local, private-network, and non-HTTP destinations. 5. Apply a restrictive Content Security Policy that blocks frames, plugins, form submissions, arbitrary connections, and unapproved scripts. 6. Run the renderer inside a disposable container or equivalent operating-system sandbox with: - No host filesystem mounts beyond required input and output files. - No network access unless strictly necessary. - A read-only root filesystem. - Dropped Linux capabilities. - CPU, memory, process, and execution-time limits. 7. Keep Puppeteer and its Chromium binary patched, and validate input and output paths before use. ]]>