T09 · Insecure Skill Coding Practices
Error
- Location
assets/skill-ui-bridge.js:13- Finding
Unsafe HTML Sanitization Permits Dangerous URLs and Unrestricted Inline CSS
- Content
View full analysis
' + html + '', 'text/html'); cleanNode(doc.body); return doc.body.innerHTML; } function cleanNode(node) { var i = node.childNodes.length; while (i--) { var child = node.childNodes[i]; if (child.nodeType === 3) continue; if (child.nodeType !== 1) { node.removeChild(child); continue; } var tag = child.tagName.toLowerCase(); if (!allowedTags.has(tag)) { var frag = document.createDocumentFragment(); while (child.firstChild) frag.appendChild(child.firstChild); node.replaceChild(frag, child); continue; } var attrs = Array.from(child.attributes); for (var a = 0; a < attrs.length; a++) { if (!allowedAttrs.has(attrs[a].name)) child.removeAttribute(attrs[a].name); } cleanNode(child); } } ``` ```javascript var wrapper = document.createElement('div'); wrapper.setAttribute(DONE_ATTR, '1'); wrapper.style.cssText = 'display:block;margin:4px 0;opacity:0;transition:opacity 0.18s ease'; wrapper.innerHTML = sanitize(text.slice(aIdx)); el.style.display = ''; el.innerHTML = ''; el.appendChild(wrapper); ``` The configured attributes include URL-bearing and unrestricted styling attributes: ```json "allowedAttrs": [ "class", "style", "id", "href", "target", "rel", "src", "alt", "width", "height", "data-card", "data-type", "data-action", "data-value", "open", "title", "viewBox", "fill", "stroke", "stroke-width", "stroke-linecap", "stroke-linejoin", "d", "cx", "cy", "r", "x", "y", "x1", "y1", "x2", "y2", "points", "xmlns" ] ``` ### Technical Analysis The custom sanitizer checks only whether an element name and attribute name appear in global allowlists. It does not inspe ...[truncated 2371 chars]- Remediation
View remediation