T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate-svg.cjs:19- Finding
SVG Markup Injection Through Unsanitized Color Arguments
- Content
View full analysis
``` The interpolated values originate directly from command-line arguments: ```js } else if (args[i] === '--primary' || args[i] === '-p') { primaryColor = args[i + 1]; i++; } else if (args[i] === '--secondary' || args[i] === '-sec') { secondaryColor = args[i + 1]; i++; } ``` ### Technical Analysis The `--primary` and `--secondary` command-line values are inserted directly into XML attribute contexts without color validation or XML escaping. A value containing a quotation mark can terminate the `stop-color` attribute and inject additional attributes or SVG elements into the generated document. SVG is an active document format in some rendering contexts. Depending on how the generated file is opened, embedded, or served, injected markup could include event handlers, links, or external-resource references. Script execution is dependent on the SVG viewer, embedding method, browser security controls, and response headers. The vulnerability becomes security-relevant when an application or agent invokes this script using color values influenced by an untrusted user and then publishes, embeds, or provides the generated SVG to another user. ### Attack Path 1. An attacker supplies a crafted value through `--primary` or `--secondary`. 2. The argument parser stores the value without validating that it is a legitimate CSS color. 3. The value is interpolated inside the quoted `stop-color` XML attribute. 4. The crafted value terminates the intended attribute an ...[truncated 931 chars]- Remediation
View remediation