T09 · Insecure Skill Coding Practices
- Location
wechat-article.sh:44- Finding
Unsanitized Markdown and Metadata Permit Active HTML Injection
- Content
View full analysis
\1<\/h2><\/div>/g' "$input" | sed 's/^## \(.*\)/
\1<\/strong><\/p>/g' | sed 's/^### \(.*\)/
\1<\/strong><\/p>/g' | sed 's/^[-*] \(.*\)/
· \1<\/p>/g' | sed 's/^[0-9]\+\. \(.*\)/
\0<\/p>/g' | sed 's/^> \(.*\)/
\1<\/strong><\/p>/g' | sed 's/\*\*\([^*]*\)\*\*/\1<\/strong>/g' | sed 's/\*\([^*]*\)\*/\1<\/em>/g' | sed 's/^\([^<].*\)$/
\1<\/p>/g' } ``` ```bash generate_tags() { local tags=$1 local html="" local tag for tag in $tags; do html="${html}${tag}" done printf '%s' "$html" } ``` ```bash content=$(convert_markdown "$input_file") tags_html=$(generate_tags "$tags") date=$(date +%Y-%m-%d) html=$(sed \ -e "s/{{TITLE}}/${title}/g" \ -e "s/{{SUBTITLE}}/${subtitle}/g" \ -e "s/{{DATE}}/${date}/g" \ -e "s/{{FOOTER_TEXT}}//g" \ -e "s#{{TAGS}}#${tags_html}#g" \ "$SCRIPT_DIR/template.html") html=$( awk ' FNR == NR { content = content $0 ORS ...[truncated 3358 chars]
- Remediation
View remediation
`, ``, `<object>`, `<embed>`, and similar active elements. - Event-handler attributes such as `onclick`, `onload`, and `onerror`. - Dangerous URL schemes such as `javascript:` and unintended `data:` URLs. - Remote resources unless they are explicitly required and approved. 4. Do not construct `sed` replacement programs from untrusted values. If `sed` remains in use, escape all replacement and delimiter metacharacters before substitution, though a proper template engine is preferred. 5. Treat local preview as a security boundary. Consider generating a restrictive Content Security Policy for local previews that blocks scripts, frames, plugins, and network access. 6. Revalidate and sanitize the final HTML immediately before upload rather than assuming that WeChat will remove dangerous markup. 7. If raw HTML support is intentionally retained, disable it by default and require an explicit unsafe option accompanied by a warning before preview or upload. 8. Add regression tests using payloads containing raw scripts, event handlers, remote images, iframes, dangerous URL schemes, closing tags, and `sed` replacement metacharacters. ]]>