T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/content360_sync.py:188- Finding
Untrusted Notion Content Embedded into HTML Without Escaping
- Content
View full analysis
{content_text}", "media": [], "url": "", "opened": True }] }) ``` The value passed as `content_text` is assembled directly from Notion-controlled properties: ```python caption = extract_text(props.get("Caption", "")) hook = extract_text(props.get("Hook", "")) cta = extract_text(props.get("CTA", "")) if hook: full_text = f"{hook}\n\n{caption}" else: full_text = caption if cta: full_text += f"\n\n{cta}" ``` ### Technical Analysis The `Caption`, `Hook`, and `CTA` fields are read from an external Notion database and treated as plain text. The resulting value is interpolated directly into an HTML fragment without HTML escaping or sanitization. An attacker who can modify records in the source Notion database can supply markup such as links, images, malformed HTML, or active elements. The script then submits that markup to Content360 as the `body` of a post. Whether JavaScript or other active content can execute depends on Content360's server-side sanitization and the rendering behavior of downstream social-media integrations. The client-side script nevertheless fails to enforce the documented plain-text trust boundary. ### Attack Path 1. An attacker obtains permission to create or edit a page in the configured Notion content calendar. 2. The attacker places crafted HTML in the page's `Caption`, `Hook`, or `CTA` property. 3. An operator runs the synchronization script without `--dry-run`. 4. The script reads the crafted value and inserts it directly into `{content_text}`. 5. The resulting HTML is submitted to Content360 and may be stored, previewed, or ...[truncated 853 chars]- Remediation
View remediation
{safe_content}" ``` 2. If limited formatting must be supported, use a maintained allowlist-based sanitizer and permit only explicitly required elements and attributes. 3. Reject active elements, event-handler attributes, dangerous URL schemes, embedded frames, and remote resource tags. 4. Validate content both when reading it from Notion and immediately before sending it to Content360. 5. Add tests covering tags, entities, malformed markup, event handlers, and `javascript:` URLs. 6. Retain or verify server-side sanitization in Content360 as defense in depth rather than relying on it as the sole protection. ]]>