T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_lookbook_images.py:513- Finding
Stored HTML Injection Through Unescaped Item IDs
- Content
View full analysis
搜索同款' li_html += f'''- {num}
''' ``` ### Technical Analysis The generator reads `items[].id` from an input JSON document and interpolates it directly into the generated HTML. Unlike adjacent text fields, the value is neither type-validated nor passed through the `esc()` HTML-encoding function. Although the documented schema describes the ID as a number, JSON parsing does not enforce that requirement. A malicious or untrusted input document can supply an arbitrary string containing HTML markup. The supplied markup will be stored in the output file and interpreted when a user opens the generated lookbook in a browser. For example, an attacker-controlled value could contain an element with an event handler: ```json { "items": [ { "id": "{action}{name}{cm} · {sc}", "name": "Example", "color_material": "Example", "scenes": "Example" } ] } ``` This is a stored HTML injection vulnerability and may become script execution depending on the injected markup and the browser's treatment of local HTML files. ### Attack Path 1. An attacker creates or modifies a `wardrobe_data.json` file. 2. The attacker places malicious HTML in an `items[].id` value. 3. A victim runs the documented generator against that file ...[truncated 1308 chars]
- {num}
- Remediation
View remediation