T09 · Insecure Skill Coding Practices
Error
- Location
scripts/padel_americano.py:747- Finding
HTML Injection During PDF Export with Chromium Sandbox Disabled
- Content
View full analysis
{rnd['round']}{m['court']}{esc(' / '.join(m['team1']))}" f"{esc(' / '.join(m['team2']))}{score}" ) ``` ```pythonPlayers: {esc(', '.join(state['players']))} | Courts: {state['courts']} | Rounds: {state['round_count'] or len(state['rounds'])} | Points/game: {state['points_per_game']}``` ```python def cmd_export_pdf(args): state = load_state(args.state) out = Path(args.out) out.parent.mkdir(parents=True, exist_ok=True) html_path = out.with_suffix(".html") html_path.write_text(html_report(state), encoding="utf-8") chrome = shutil.which("google-chrome") or shutil.which("chromium") or shutil.which("chromium-browser") if not chrome: print(f"No Chrome/Chromium found. Wrote HTML instead: {html_path}") return subprocess.run([ chrome, "--headless", "--disable-gpu", "--no-sandbox", f"--print-to-pdf={out}", html_path.as_uri(), ], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) print(f"Exported {out}") ``` ### Technical Analysis The application loads tournament state directly from a JSON file and does not validate it against a strict schema. Although tournament and player names are escaped in the HTML report, several other JSON-derived fields are inserted into HTML without escaping, including: - Round identifiers - Court identifiers - Score ele ...[truncated 2719 chars]- Remediation
View remediation
{esc(rnd['round'])}{esc(m['court'])}" ``` The score should also be escaped after formatting: ```python score = "-" if not m.get("score") else f"{m['score'][0]}-{m['score'][1]}" safe_score = esc(score) ``` 3. **Remove `--no-sandbox`** - Run Chromium with its normal sandbox enabled. - If the deployment environment cannot support the Chromium sandbox, perform conversion inside a separately isolated container or restricted worker account. - Limit the worker's filesystem access and disable network access when it is not required. 4. **Restrict browser capabilities** - Disable JavaScript for report rendering where supported. - Block external network requests and external resource loading. - Use a restrictive Content Security Policy, such as one that permits only inline styles required by the report and denies scripts, frames, objects, and network connections. 5. **Handle generated HTML securely** - Create intermediate files with restrictive permissions. - Prefer a secure temporary directory. - Remove the intermediate HTML after successful PDF creation unless the user explicitly requests an HTML copy. - Avoid overwriting unrelated files through ambiguous output paths. 6. **Fail safely** - Report Chr ...[truncated 168 chars]