T09 · Insecure Skill Coding Practices
Warning
- Location
references/components/upload.md:10- Finding
Upload Examples Transmit User-Selected Files to an External Third-Party Service
- Content
View full analysis
``` Equivalent hard-coded external upload actions appear in several other copyable examples: ```html ``` ```html ``` ### Technical Analysis The `action` property determines the server to which Element UI sends selected file contents. Most examples use Element UI's default automatic-upload behavior, so selecting a file can immediately generate an HTTPS POST request to `jsonplaceholder.typicode.com`. Network-based upload behavior is legitimate for documenting the Upload component. However, transmitting files to an unrelated third-party demonstration service is not required to fulfill that purpose and exceeds the minimum external access necessary for a safe example. A user may copy and run the example without recognizing that a locally selected file will leave their environment. The examples include client-side file restrictions in some cases, but these restrictions do not prevent disclosure to the configured endpoint. They only control whether the browser initiates an upload based on client-visible properties. The thi ...[truncated 1465 chars]- Remediation
View remediation
``` 2. Set `:auto-upload="false"` in documentation examples so selecting a file does not immediately cause network transmission. 3. Add a visible warning next to every upload example stating that: - The `action` endpoint receives the complete selected file. - Users must replace it with an endpoint they own and trust. - Production systems must authenticate requests and validate files server-side. 4. If a live demonstration is necessary, use a local mock request function that does not transmit data: ```html ``` ```javascript methods: { mockUpload({ file, onSuccess }) { console.info('Demo only; file was not transmitted:', file.name); onSuccess({ simulated: true }); } } ``` 5. Preserve the existing production security guidance concerning server-side type, size, and content validation, but place the warning directly beside the copyable examples rather than only in the general Skill instructions. ]]>