T09 · Insecure Skill Coding Practices
Error
- Location
scripts/publisher.py:148- Finding
JavaScript Injection Through Unescaped Product Data
- Content
View full analysis
bool: return await self.evaluate( f"(function(){{var el=document.querySelector('input[placeholder*=\"{placeholder}\"]')||document.querySelector('textarea[placeholder*=\"{placeholder}\"]');if(el){{el.value=`{value}`;el.dispatchEvent(new Event('input',{{bubbles:true}}));return true}}return false}})()" ) ``` A second exploitable data flow inserts delivery text directly into a JavaScript template literal: ```python await page.evaluate(f"""(function() {{ var ta = document.querySelector('.addproduct-dialog textarea, .el-dialog__body textarea'); if (ta) {{ ta.value = `{pan_text}`; ta.dispatchEvent(new Event('input', {{ bubbles: true }})); }} }})()""") ``` The extraction code and title are similarly interpolated into JavaScript: ```python await page.evaluate(f"""(function() {{ var inputs = document.querySelectorAll('.addproduct-dialog input, .el-dialog__body input'); for (var inp of inputs) {{ if (inp.placeholder && (inp.placeholder.includes('提取码') || inp.placeholder.includes('密码'))) {{ inp.value = '{pan_code}'; inp.dispatchEvent(new Event('input', {{ bubbles: true }})); return; }} }} }})()""") ``` ```python target_row_index = await page.evaluate(f"""(function() {{ var trs = document.querySelectorAll('.el-table__body-wrapper tbody tr'); for (var i = 0; i < trs.length; i++) {{ var tds = trs[i].querySelectorAll('td'); ...[truncated 2452 chars]- Remediation
View remediation