T09 · Insecure Skill Coding Practices
Error
- Location
- submit-quiz.js:30
- Finding
- Irreversible Quiz Submission Without Explicit User Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `submit-quiz.js:30-44`; equivalent behavior also occurs in `complete-quiz.js:150-159` **Vulnerability Type**: Missing authorization checkpoint for a consequential action **Risk Level**: High ### Vulnerable Code ```javascript // 查找 Submit 按钮 const submitBtn = await page.$('button:has-text("Submit")'); if (submitBtn) { console.log('\n🖱️ 点击 Submit...'); await submitBtn.click({ force: true }); await page.waitForTimeout(3000); // 查找确认按钮 const confirmBtn = await page.$('button:has-text("Yes"), button:has-text("Confirm")'); if (confirmBtn) { console.log('🖱️ 确认提交...'); await confirmBtn.click({ force: true }); await page.waitForTimeout(5000); console.log('✅ 测验已提交！'); ``` The fully automated workflow contains the same issue: ```javascript const submitBtn = await page.$('button:has-text("Submit")'); if (submitBtn) { await submitBtn.click({ force: true }); await page.waitForTimeout(3000); // 确认提交 const confirmBtn = await page.$('button:has-text("Yes"), button:has-text("Confirm")'); if (confirmBtn) { console.log('🖱️ 确认提交'); await confirmBtn.click({ force: true }); await page.waitForTimeout(5000); } ``` ### Technical Analysis Both submission workflows click the initial `Submit` control and then automatically click a `Yes` or `Confirm` control. The scripts print warnings, but no interactive authorization is requested after the user can review the exact course, assignment, and selected answers. A console message is not a security boundary. Once either script starts, it can complete the irreversible submission without another affirmative user action. This also conflicts with documentation that represents submission as requiring confirmation. The use of `{ force: true }` further bypasses Playwright actionability safeguards that would ordinarily reject interactions with obscured, disabled, or otherwise unsuitable elements. ### Attack Path 1. The user has an a ...[truncated 1008 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require an explicit interactive confirmation immediately before the final confirmation click, such as typing the exact assignment name. 2. Display the trusted origin, course, assignment, number of answered questions, and unanswered-question count before requesting approval. 3. Abort by default if interactive input is unavailable or if any expected value cannot be verified. 4. Validate that the current URL uses the exact `https://apclassroom.collegeboard.org/` origin and an expected quiz route. 5. Use assignment-specific selectors rather than generic text selectors. 6. Remove `{ force: true }` from submission and confirmation actions. 7. Separate preparation from submission: the default command should stop at a review screen, while final submission should require a distinct, explicitly authorized operation. 8. Add a dry-run mode and make it the default. ]]>