T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_ppt.py:154- Finding
Untrusted Word Content Is Parsed as Raw XML
- Content
View full analysis
' ) run_elem.append(rPr_elem) t_elem = etree.fromstring(f'{text}') run_elem.append(t_elem) para_elem.append(run_elem) txBody.append(para_elem) ``` The relevant input source is: ```python doc_word = DocxDoc(word_doc_path) word_paragraphs = [p.text.strip() for p in doc_word.paragraphs] ``` The `text` value is not XML-escaped before parsing. Ordinary input containing reserved XML characters such as `&` or `<` can therefore produce an `XMLSyntaxError`. Carefully structured content may close the expected `a:t` element and introduce additional XML nodes if the final interpolated document remains well-formed. This is an XML injection flaw, although it does not expose an external-entity issue by itself because the injected value is placed in an in-memory XML fragment without a document type declaration. ### Attack Path 1. An attacker influences market or news content included in the generated Word report. 2. The attacker places XML-reserved characters or crafted XML markup in a paragraph expected at one of the fixed paragraph indexes processed by the script. 3. The script loads that paragraph into `word_paragraphs`. 4. The paragraph is passed to `rebuild_txBody()` as `text`. 5. The script interpolates the value into an XML document without escaping it. 6. `etree.fromstring()` either raises a parsing exception, terminating report generation, or ac ...[truncated 554 chars]- Remediation
View remediation
`, quotation marks, and attempted closing tags. ]]>