T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/video_engine.py:420- Finding
CSS Injection Through Unvalidated Style Values
- Content
View full analysis
str: return str(value if value is not None else "").replace("\\", "\\\\").replace('"', '\\"') ``` ```python def _layout_css(layout: str, width: int, height: int, font: str) -> str: """Return layout-specific CSS.""" common = f''' * {{ box-sizing: border-box; margin: 0; }} html, body {{ width: 100%; height: 100%; overflow: hidden; background: var(--bg); color: var(--fg); font-family: {font}, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }} ``` ```python palette = list((project.get("style") or {}).get("palette") or ["#0B0F19", "#F8FAFC", "#22D3EE", "#A3E635"]) while len(palette) < 4: palette.append(palette[-1]) font = str((project.get("style") or {}).get("font") or "Inter") ``` ```python :root {{ --w: {width}px; --h: {height}px; --duration: {duration:.3f}s; --bg: {_css_string(palette[0])}; --fg: {_css_string(palette[1])}; --accent: {_css_string(palette[2])}; --accent-2: {_css_string(palette[3])}; }} ``` ### Technical Analysis The request schema describes palette entries as hexadecimal colors and the font as a CSS font-family name, but the implementation does not enforce either constraint. The `font` value is inserted directly into a generated stylesheet. Palette values are passed through `_css_string()`, which only escapes backslashes and double quotes. It does not neutralize CSS delimiters such as semicolons, braces, comments, or `url(...)`. Consequently, an attacker who can control the video request may terminate the intended CSS declaration and inject additional stylesheet rules. Injected CSS can alter the generated project, hide or falsify disp ...[truncated 1596 chars]- Remediation
View remediation
str: if not HEX_COLOR.fullmatch(value): raise ValueError("Palette entries must be six- or eight-digit hexadecimal colors.") return value ``` 2. Restrict fonts to a predefined allowlist of supported system fonts. If arbitrary family names are required, permit only a conservative character set and emit the name as a properly quoted CSS string. 3. Reject style values containing braces, semicolons, comments, control characters, `url`, `@import`, or other CSS constructs. 4. Do not rely on generic string replacement for CSS safety. Use context-specific validation and serialization. 5. Add tests using malicious values such as declaration terminators, braces, comments, `url(...)`, and `@import` to ensure they are rejected before HTML generation. 6. Consider applying a restrictive Content Security Policy to generated projects, such as blocking remote image, font, media, and style sources unless explicitly needed. ]]>