T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/pptx_layout_dump.py:20- Finding
Unsafe XML Parsing of Untrusted PPTX Content in Layout Analyzer
- Content
View full analysis
etree._Element: parser = etree.XMLParser(remove_blank_text=False, recover=True) return etree.fromstring(blob, parser=parser) ``` ### Technical Analysis PPTX documents are ZIP archives containing XML documents controlled by the file provider. The layout analyzer passes those XML documents to `lxml.etree.XMLParser` without explicitly disabling DTD loading and entity resolution. The parser also enables recovery mode. This causes malformed, potentially malicious XML to be processed where strict parsing would otherwise reject it. Security consequently depends on the behavior and version-specific defaults of the installed `lxml` and `libxml2` libraries. If entity expansion or external entity processing is available in the runtime configuration, a crafted PPTX may attempt to reference local files or cause excessive entity expansion. Extracted XML text is subsequently included in the generated JSON report, creating a potential path for resolved local-file content to reach command output. The script also reads ZIP members directly without checking their declared or actual uncompressed sizes. A malicious PPTX containing highly compressed or extremely large XML members can therefore cause excessive memory or CPU consumption. ### Attack Path 1. An attacker creates a PPTX archive containing a malicious `ppt/presentation.xml`, theme XML, or slide XML. 2. The attacker provides the file as the source deck for layout analysis. 3. The script opens the archive and reads the attacker-controlled XML member into memory without applying size limits. 4. `parse_xml` processes the content with recovery enabled and without explicit DTD and entity restrictions. 5. Depending on the installed parser configuration, malicious entities ...[truncated 891 chars]- Remediation
View remediation
etree._Element: if b"