T09 · Insecure Skill Coding Practices
Error
- Location
scripts/md-pdf-render.mjs:79- Finding
Untrusted Markdown Can Execute Active Content with Unrestricted Network Access
- Content
View full analysis
${hljsCss} ${katexCss} ${baseCSS} ${extraCss} ${mermaidStyles} ${htmlBody} ${mermaidScript} `; ``` ```js const browser = await puppeteer.launch({ headless: true }); const page = await browser.newPage(); await page.setContent(fullHtml, { waitUntil: 'load', timeout }); ``` ### Technical Analysis The Markdown parser explicitly enables raw HTML through `html: true`. The resulting HTML is inserted directly into a Puppeteer page without sanitization. Chromium JavaScript execution remains enabled, and the renderer does not configure request interception, a Content Security Policy, or a network allowlist. Consequently, an attacker-controlled Markdown document can contain executable HTML such as `- Remediation
View remediation
{ const url = new URL(request.url()); if (url.protocol === 'data:' || url.protocol === 'about:') { request.continue(); } else { request.abort(); } }); ``` 5. If remote resources are a required feature, make them an explicit opt-in and enforce: - HTTPS-only requests. - A documented hostname allowlist. - Blocking of loopback, link-local, private, and metadata-service addresses. - Redirect revalidation. - Response-size and timeout limits. 6. Add a restrictive Content Security Policy to the generated page. 7. Clearly document that untrusted Markdown must not be rendered with active HTML or remote-resource access enabled. ]]>