T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate.py:135- Finding
Stored HTML and JavaScript Injection in Generated Reports
- Content
View full analysis
'] parts.append(f'{self.num}{self.title}') parts.append(f'{self.desc}') self.builder._sections_html.append("\n".join(parts)) self.builder._in_section = True return self ``` ```python def table(self, headers: list, rows: list): ths = "".join(f"{h}" for h in headers) trs = "" for row in rows: tds = "".join(f"{cell}" for cell in row) trs += f"{tds}" html = f'{ths}{trs}
' self._add_html(html) return self ``` ```python def raw_html(self, html: str): self._add_html(html) return self ``` ```python def insight(self, title: str, bullets: list): lis = "".join(f"- {b}
" for b in bullets) html = f'' self._add_html(html) return self ``` ```python # 替换占位符 tmpl = tmpl.replace("{{TITLE}}", self.title) tmpl = tmpl.replace("{{HEADER_TITLE}}", self._header_title) tmpl = tmpl.replace("{{HEADER_SUBTITLE}}", self._header_sub) tmpl = tmpl.replace("{{HEADER_META}}", meta_html) tmpl = tmpl.replace("{{NAV_LINKS}}", nav_html) tmpl = tmpl.replace("{{SECTIONS}}", sections_html) tmpl = tmpl.replace("{{FOOTER}}", self._footer) tmpl = tmpl.replace("{{CHART_SCRIPTS}}", charts_js) tmpl = tmpl.replace("__CHART_INSTANCES__", f"[{instances_str}]") ``` The associated documentation expressly permits arbitrary HTML: ```python ## raw_html r.raw_html('{title}
- {lis}
任意 HT ...[truncated 2854 chars]- Remediation
View remediation
alert(1)` - `` - `" onmouseover="alert(1)` - `` 9. Clearly document which APIs accept plain text and ensure safe APIs are the default. ]]>