T09 · Insecure Skill Coding Practices
Error
- Location
index.js:78- Finding
Unsanitized Presentation Data Enables HTML and CSS Injection
- Content
View full analysis
${config.title} ``` ```js body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; background: ${config.backgroundColor}; color: ${config.textColor}; height: 100vh; overflow: hidden; } ``` ```js h1 { font-size: 4rem; font-weight: 700; margin-bottom: 20px; letter-spacing: -0.02em; color: ${config.accentColor}; } ``` ```js button { background: ${config.accentColor}; color: white; border: none; padding: 12px 24px; font-size: 1.2rem; border-radius: 8px; cursor: pointer; margin: 0 10px; transition: opacity 0.2s; } ``` The author and slide content are also rendered as raw markup: ```js${config.author}Slide 1 of ${slides.length}${slides.map((slide, index) => ```` ### Technical Analysis `generatePPT()` accepts presentation content and an `options` object. These inputs flow into `gener ...[truncated 2542 chars]${slide.type === 'title' ? ``).join('')}${slide.content}
` : slide.type === 'bullets' ? `${slide.title}
-
${slide.content.split(/[•\-*]/).filter(item => item.trim()).map(item => `
- ${item.trim()} `).join('')}
${slide.title}
${slide.content}
`}- Remediation
View remediation
`, `"`, and `'` before inserting titles, authors, slide content, and bullet items into the template. ```js function escapeHTML(value) { return String(value) .replaceAll('&', '&') .replaceAll('<', '<') .replaceAll('>', '>') .replaceAll('"', '"') .replaceAll("'", '''); } ``` Apply this function independently to every value rendered as text. Do not escape the completed HTML document as a whole. 2. **Strictly validate CSS configuration values.** Use an allowlist for accepted color formats rather than inserting arbitrary strings. For example, accept only normalized hexadecimal colors if that meets the feature requirements: ```js function validateHexColor(value, fallback) { return typeof value === 'string' && /^#[0-9a-fA-F]{6}$/.test(value) ? value : fallback; } ``` 3. **Prefer safe DOM construction where practical.** Create content nodes and assign untrusted values through `textContent`. If limited markup is intentionally supported, process it with a reputable sanitizer configured with a minimal element and attribute allowlist. Event-handler attributes, script-capable URLs, `