T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cdp_publish.py:1944- Finding
Authenticated-Origin HTML Injection Through Unsafe Editor Content Rendering
- Content
View full analysis
' + paragraphs[i] + ''); if (i < paragraphs.length - 1) {{ html.push('
'); }} }} el.innerHTML = html.join(''); el.dispatchEvent(new Event('input', {{ bubbles: true }})); }})(); """) print("[cdp_publish] Content set.") return ``` ### Technical Analysis The content is initially serialized with `json.dumps`, which safely embeds it as a JavaScript string literal. That protection does not apply when the resulting string is subsequently treated as HTML. Each paragraph is concatenated directly into an HTML fragment: ```javascript html.push('' + paragraphs[i] + '
'); ``` The completed fragment is then assigned to `el.innerHTML`. No HTML escaping or sanitization is performed before th ...[truncated 2477 chars]- Remediation
View remediation