T09 · Insecure Skill Coding Practices
Error
- Location
scripts/convert.mjs:18- Finding
Stored HTML and JavaScript Injection in Generated Documents
- Content
View full analysis
$1'); // Bold text = text.replace(/\*\*(.+?)\*\*/g, "$1"); // Italic text = text.replace(/\*(.+?)\*/g, "$1"); // Links [text](url) text = text.replace(/\[([^\]]+)\]\(([^)]+)\)/g, '$1'); // Images  text = text.replace(/!\[([^\]]*)\]\(([^)]+)\)/g, ''); // Strikethrough text = text.replace(/~~(.+?)~~/g, "
$1"); return text; } ``` Representative output sinks include: ```js tableRows[0].forEach((cell) => { html.push(`${parseInline(cell)}`); }); ``` ```js const text = headingMatch[2]; const id = `sec-${idCounter++}`; html.push(`${parseInline(text)}`); ``` ```js html.push(`- ${parseInline(ulMatch[1])}
`); ``` The generated body is subsequently embedded directly into the standalone HTML document: ```js ${tocHtml} ${body} ``` ### Technical Analysis The converter treats Markdown input as untrusted source material but does not HTML-escape ordinary text before applying inline formatting. Captured values are inserted directly into HTML element bodies and attributes. In particular: - Link URLs are interpolated directly into `href="$2"` without attribute escaping. - Image URLs and alternative text are interpolated into attributes without escaping. - Inline-code contents and formatting captures are inserted into element bodies without HTML escaping. - Raw HTML in ordinary Markdown text is preserved and emitted into ...[truncated 2462 chars]- Remediation
View remediation
` elements. - Inline event handlers such as `onclick` and `onerror`. - Dangerous URL schemes. - Unexpected active elements and attributes. 5. Avoid constructing HTML attributes with direct string interpolation. Use a reviewed Markdown parser and sanitizer, or dedicated encoding functions for each output context. 6. Add regression tests covering at least: ```md[click](x" onclick="alert(1)) [click](javascript:alert(1)) `