T09 · Insecure Skill Coding Practices
Warning
- Location
omega-notation.ts:30- Finding
Unescaped Fields Allow Forged Omega Message Injection
- Content
View full analysis
= 0 ? '+' : ''}${msg.deltaFitness}`; break; case 'route': line = `r.d "${msg.name ?? 'handler'}" {to:${msg.to ?? 'next'}`; if (msg.priority) line += ` pri:${msg.priority}`; line += '}'; break; case 'policy': line = `p.e "${msg.name ?? 'policy'}" {if:${msg.condition ?? 'true'} then:${msg.action ?? 'proceed'}}`; break; case 'tier': line = `t.es {from:${msg.fromTier ?? 1} to:${msg.toTier ?? 2} reason:"${msg.reason ?? 'low-conf'}"}`; break; case 'media': line = `m.c "${msg.name ?? 'vid'}" {h:phash:${msg.hash ?? 'none'} len:${msg.length ?? 0} cap:"""${msg.summary ?? ''}"""}`; break; } if (msg.tags && msg.tags.length > 0) { msg.tags.forEach(t => { line += ` [${t.cat}:${t.val}]`; }); } return line; } export function serialize(packet: OmegaPacket): string { const dictStr = typeof packet.dict === 'string' ? packet.dict : JSON.stringify(packet.dict); let output = `!omega v${packet.version} dict=${dictStr}\n`; output += packet.messages.map(serializeOne).join('\n'); return output.trim(); } ``` The corresponding decoder treats every newline-delimited entry as an independent message: ```ts export function deserialize(text: string): OmegaPacket { const lines = text.trim().split('\n'); const packet: OmegaPacket = { version: 1, dict: 'auto', mess ...[truncated 3117 chars]- Remediation
View remediation