T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/index.js:300- Finding
Unsanitized Theme and Cell Style Values Permit HTML/CSS Injection and Browser-Initiated Requests
- Content
View full analysis
= 600) style += 'font-weight: 600;'; } return `${escapeHtml(formatted)}`; ``` ```javascript // Set content await page.setContent(html, { waitUntil: 'networkidle' }); ``` ### Technical Analysis The renderer accepts custom theme properties and column style values and directly interpolates them into a generated HTML document. These values are not restricted to valid color syntax and are not escaped for their CSS or HTML attribute contexts. The table's textual content is processed by `escapeHtml()`, but that protection does not apply to values such as: - `themeColors.background` - `themeColors.text` - Other custom theme color properties used in generated CSS - `cellStyle.color` A malicious theme value can terminate the intended CSS declaration and introduce another declaration containing `url(...)`. A malicious `cellStyle.color` value can additionally terminate the quoted `style` attribute and inject new HTML elements. The generated document is subsequently loaded into Chromium using `page.setContent()`. No request interception or outbound network restriction ...[truncated 2295 chars]- Remediation
View remediation
route.abort()); await page.setContent(html, { waitUntil: 'domcontentloaded' }); ``` If external resources are later required, implement an explicit allowlist of schemes, hosts, ports, and resource types. Block loopback, link-local, private, multicast, and cloud metadata address ranges after DNS resolution, and account for redirects and DNS rebinding. 4. **Add a restrictive Content Security Policy** Include a CSP that prevents resource retrieval and script execution, for example: ```html ``` Network interception should remain ...[truncated 587 chars]