T09 · Insecure Skill Coding Practices
Warning
- Location
assets/report_template.html:52- Finding
Unvalidated External URL in Generated HTML Report
- Content
View full analysis
参考笔记： {% for link in hotspot.ref_links %} 笔记{{loop.index}} {% endfor %} ``` ### Technical Analysis The template inserts each value from `hotspot.ref_links` directly into an anchor element's `href` attribute. Based on the documented workflow, these links are derived from externally collected content. The audited package contains no validation that limits URLs to safe schemes or trusted Xiaohongshu domains. Context-aware HTML escaping may prevent an attacker from breaking out of the attribute, but it does not necessarily prevent dangerous URI schemes such as `javascript:` or redirects to attacker-controlled phishing sites. Consequently, a malicious or poisoned data record could become an active hyperlink in the generated report. The link also uses `target="_blank"` without `rel="noopener noreferrer"`. Although modern browsers commonly isolate new tabs by default, explicitly applying these values provides stronger protection against opener-based manipulation in older or embedded HTML viewers. ### Attack Path 1. An attacker introduces a crafted reference URL into content consumed by the hotspot collection workflow. 2. The workflow stores the crafted value in `hotspot.ref_links`. 3. The report renderer substitutes the value into the `href` attribute without scheme or destination validation. 4. A recipient opens the generated HTML report and clicks the reference link. 5. Depending on the URL and rendering environment, the link may execute script through an unsafe URI scheme or redirect the recipient to an attacker-controlled phishing or malware page. Successful exploitation requires attacker influence over a collected reference URL and user interaction with the ...[truncated 647 chars]- Remediation
View remediation
笔记{{ loop.index }} ``` 7. If invalid URLs must remain visible, render them as inert text rather than clickable links. 8. Add automated tests covering unsafe schemes, mixed-case schemes, encoded control characters, deceptive hostnames, malformed URLs, and valid trusted HTTPS URLs. ]]>