T09 · Insecure Skill Coding Practices
Error
- Location
eval-viewer/generate_review.py:273- Finding
Stored JavaScript Injection Through Embedded Evaluation Output
- Content
View full analysis
// ---- Embedded data (injected by generate_review.py) ---- /*__EMBEDDED_DATA__*/ ``` ### Technical Analysis `generate_review.py` recursively reads evaluation output files and includes their content in the `embedded` object. The resulting object is serialized with `json.dumps()` and inserted directly into an HTML ` ``` the HTML parser treats the first `` as the end of the original script element, even though the sequence appears inside a JavaScript string. The following script element is then parsed and executed. This is a stored injection issue because the payload can be placed in an evaluation output file and later executed automatically when the generated review page is opened. Evaluation outputs may be influenced by untrusted prompts, generated artifacts, tested Skills, or compromised tools. The use of `textContent` when rendering ordinary text later in `viewer.html` does not mitigate this vulnerability because execution occurs while the browser initially parses the generated HTML. ### Attack Path 1. An attacker supplies a test prompt, input artifact, Skill, or generated output that causes a file under an evaluation run's ...[truncated 1774 chars]- Remediation
View remediation
` element. 2. Store the serialized data in a non-executable element and parse its text explicitly: ```html ``` 3. Before inserting JSON into HTML, escape characters significant to the HTML parser: ```python data_json = json.dumps(embedded) data_json = ( data_json .replace("&", "\\u0026") .replace("<", "\\u003c") .replace(">", "\\u003e") .replace("\u2028", "\\u2028") .replace("\u2029", "\\u2029") ) ``` Escaping `<` is essential because it prevents construction of ``. 4. Prefer a well-reviewed HTML templating or serialization utility that explicitly supports safe JSON embedding. 5. Add regression tests using output content containing: - `` - HTML event handlers - U+2028 and U+2029 - nested JSON and multiline source files 6. Add a restrictive Content Security Policy. Avoid inline scripts where possible and use hashes or nonces for trusted scripts. Restrict `connect-src`, `img-src`, `frame-src`, and `script-src` to the minimum required origins. 7. Treat all evaluation outputs as untrusted, even when they were generated locally. ]]>