T09 · Insecure Skill Coding Practices
Warning
- Location
context_report.py:247- Finding
Stored HTML Injection Through Unescaped Conversation Role
- Content
View full analysis
0 else 0 bars_html += f"""{section.source} {section.estimated_tokens:,} tokens ({percentage:.1f}%) ``` ### Technical Analysis When a JSON conversation is analyzed, the value of each message's `role` property is copied into `TokenEstimate.source`. The report generator later inserts this value into an HTML template without applying `_escape_html()`. This creates a stored HTML injection vulnerability. A crafted role such as: ```json [ { "role": "", "content": "Example content" } ] ``` will be emitted as active markup in the generated report. When a user opens the report in a browser, event-handler JavaScript may execute. The report generator correctly escapes compression-suggestion text, but it does not consistently apply that protection to section source labels. This inconsistent output encoding is the root cause. ### Attack Path 1. An attacker creates or modifies a conversation JSON file containing an HTML or JavaScript payload in a message's `role` field. 2. The attac ...[truncated 1443 chars]
- Remediation
View remediation
{safe_source} {section.estimated_tokens:,} tokens ({percentage:.1f}%)""" ``` Additional hardening should include: 1. Use an HTML templating engine with automatic escaping instead of constructing markup through f-strings. 2. Validate conversation roles against an allowlist such as `system`, `user`, `assistant`, and `tool` when arbitrary role names are unnecessary. 3. Escape all dynamic textual fields at the output boundary, even if they are currently numeric or internally generated. 4. Add a restrictive Content Security Policy to generated reports, for example: ```html ``` 5. Add regression tests using payloads containing `