T09 · Insecure Skill Coding Practices
Error
- Location
eval-viewer/generate_review.py:279- Finding
Stored JavaScript Injection Through Unescaped Embedded Evaluation Data
- Content
View full analysis
` element in `viewer.html`. JSON encoding does not make data safe for embedding in an HTML script context. In particular, it does not escape the HTML parser sequence ``. An attacker-controlled output containing a value such as: ```html ``` can terminate the original script element and introduce a new executable script element. This occurs at the HTML parsing layer before JavaScript string or JSON semantics can protect the content. The affected data is not necessarily trusted. `embed_file()` reads files produced by evaluated skills, while prompts, grading evidence, benchmark notes, and prior outputs can also contain externally influenced content. The declared workflow directs users to open this viewer, making stored payload execution a realistic attack surface. ### Attack Path 1. An attacker supplies a malicious prompt, evaluated skill, input file, or other content that causes an evaluation output file to contain a `` payload. 2. `generate_review.py` reads the generated file and places its contents in the `embedded` object. 3. `json.dumps(embedded)` preserves the literal `` sequence. 4. `generate_html()` inserts the serialized object into the executable script block in `viewer.html`. 5. ...[truncated 1122 chars]- Remediation
View remediation
``` Populate it with safely encoded text and load it with: ```javascript const EMBEDDED_DATA = JSON.parse( document.getElementById("embedded-data").textContent ); ``` 3. At minimum, replace HTML-significant characters before script-context insertion: ```python data_json = json.dumps(embedded).replace("<", "\\u003c") ``` Escaping `<` prevents construction of the `` termination sequence. Escaping `>`, `&`, U+2028, and U+2029 should also be considered for robust cross-environment safety. 4. Add a restrictive Content Security Policy that blocks inline and unauthorized external scripts. Prefer a nonce- or hash-based policy. 5. Add regression tests using output, prompt, grading, and benchmark values containing: - `` - `` - HTML event handlers - Unicode and malformed markup variants 6. Treat all evaluated outputs as hostile content, regardless of file extension. ]]>