T09 · Insecure Skill Coding Practices
Error
- Location
scripts/render_booking.py:257- Finding
HTML and JavaScript Injection Through Unvalidated Booking URLs
- Content
View full analysis
' f'{COPY_SVG}' f'{u}' f'' ) ``` ### Technical Analysis The renderer processes URL values from `data.json` using `html.escape()` and then inserts the result into two different security-sensitive contexts: 1. An inline JavaScript string inside the `onclick` attribute. 2. An HTML `href` attribute. HTML escaping alone is not sufficient for a JavaScript-string context. Character references such as `'` are decoded by the browser before the inline event handler is compiled as JavaScript. Consequently, an attacker-controlled apostrophe can terminate the string argument passed to `copyLink()` and inject additional JavaScript. The `href` value is also accepted without URL parsing or scheme validation. A value using a dangerous scheme such as `javascript:` can therefore be emitted as an active link. No Content Security Policy is generated to prevent inline script execution. Although the normal workflow expects URLs from FlyAI, the renderer accepts an arbitrary local JSON file through `--data`. Exploitation is possible if the JSON file is supplied by an untrusted party, modified before rendering, or populated from a compromised upstream response. ### Attack Path 1. An attacker controls or influences a URL field in `data.json`, including a flight, hotel, or attraction URL. 2. The attacker supplies a value that either: - breaks out of the JavaScript string in the inline `onclick` handler, or - uses a dangerous scheme such as `javascript:`. 3. The user runs `render_booking.py` against the malicious data. 4. The script writes the value into ...[truncated 920 chars]- Remediation
View remediation