T09 · Insecure Skill Coding Practices
Warning
- Location
reporter.py:87- Finding
Stored HTML Injection Through Unescaped Report Data
- Content
View full analysis
投放数据分析报告 - {date_range} ...📊 投放数据分析报告
日期范围: {date_range} | 生成时间: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}...""" ``` ### Technical Analysis The HTML report is assembled through direct string interpolation. Spreadsheet cell values are converted to text with `DataFrame.to_string()` and inserted inside `🔍 数据样本
超级直播数据（前5行）
text {super_df.head().to_string() if not super_df.empty else '无数据'}淘宝直播数据（前5行）
text {taobao_df.head().to_string() if not taobao_df.empty else '无数据'}财务报表数据（前5行）
text {financial_df.head().to_string() if not financial_df.empty else '无数据'}text ` elements without HTML escaping. The externally supplied `date_range` value is also embedded in the document title and body without validation or escaping. The `
text ` element does not neutralize HTML markup. A malicious CSV cell containing a payload such as: ```html
text ``` closes the existing element and introduces an executable script. Because the resulting payload is stored in the generated report, it executes when a user opens that HTML file in a browser. The generated document also lacks a Content Security Policy, so there is no secondary browser-side control preventing inline script execution. ### Attack Path 1. An attacker creates or modifies a CSV file whose fi ...[truncated 1383 chars]
- Remediation
View remediation
``` 5. Add regression tests containing ``, `