T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/add_event.py:51
- Finding
- Unescaped User Input Permits iCalendar Content Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/add_event.py`, lines 51–66 **Vulnerability Type**: iCalendar content injection caused by unsafe serialization **Risk Level**: Medium ### Vulnerable Code ```python SUMMARY:{title} DESCRIPTION:{description} STATUS:CONFIRMED SEQUENCE:0 BEGIN:VALARM TRIGGER:-PT{alarm_minutes}M ACTION:DISPLAY DESCRIPTION:{title} END:VALARM BEGIN:VALARM TRIGGER:-PT5M ACTION:DISPLAY DESCRIPTION:马上开始: {title} ``` ### Technical Analysis The user-supplied `title` and `description` values are interpolated directly into an iCalendar document without RFC 5545 escaping or validation. iCalendar text fields require special handling for backslashes, commas, semicolons, and line breaks. An attacker who controls either argument can include newline characters followed by additional iCalendar properties or component delimiters. Depending on iCloud CalDAV parsing behavior, this may modify the generated event's semantics, inject extra alarms or properties, prematurely terminate a component, or cause malformed calendar data to be uploaded. The current script also lacks strict timestamp validation and uses manual string construction instead of a format-aware serializer. ### Attack Path 1. The attacker supplies or influences an event title or description processed by the Skill. 2. The value contains CR/LF characters followed by attacker-selected iCalendar directives. 3. `create_ics_event()` inserts the value directly into the `.ics` document. 4. `add_event_to_icloud()` submits the resulting document to the configured iCloud calendar through an authenticated CalDAV PUT request. 5. If accepted by the server, the injected directives alter calendar content beyond the intended title or description field. For example, an input containing a newline followed by additional `VALARM` or event properties could change event behavior rather than remaining ordinary text. ### Impact Assessment Exploitation is limited to the authenticated calendar ...[truncated 594 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use a maintained iCalendar library rather than constructing calendar documents with string interpolation. 2. Escape all RFC 5545 text values, including backslashes, commas, semicolons, carriage returns, and line feeds. 3. Reject unexpected CR or LF characters in scalar fields such as the title. 4. Validate start and end timestamps against an explicit accepted format and ensure that the end time follows the start time. 5. Apply length limits to titles and descriptions. 6. Add tests using malicious values containing `\r`, `\n`, `BEGIN:`, `END:`, `VALARM`, commas, semicolons, and backslashes. 7. Confirm that the final serialized document contains exactly one intended `VEVENT` before transmission. ]]>