T09 · Insecure Skill Coding Practices
Error
- Location
scripts/dashboard.html:520- Finding
Stored Cross-Site Scripting in Transaction Dashboard
- Content
View full analysis
{ const ka = state.sortKey; let va = a[ka], vb = b[ka]; if (ka === 'amount') { va = Number(va); vb = Number(vb); return mult * (va - vb); } return mult * String(va || '').localeCompare(String(vb || ''), 'zh-CN'); }); rows.forEach((r) => { const tr = document.createElement('tr'); const tag = r.type === '收入' ? 'tag-in' : 'tag-out'; tr.innerHTML = `${r.date}${r.type}${r.category}` + `${fmtMoney(r.amount)}${(r.note || '').replace(/`; tb.appendChild(tr); }); } ``` The corresponding CLI accepts database-controlled values without validating the date format or constraining the category: ```python date_str = str(payload["date"]) type_ = str(payload["type"]) category = str(payload["category"]) amount = float(payload["amount"]) ``` ```python if type_ not in ("收入", "支出"): issues.append("type must be income or expense") if type_ == "支出" and category not in expense_defaults: pass # custom categories allowed if type_ == "收入" and category not in income_defaults: pass ``` ### Technical Analysis The dashboard constructs table rows through `innerHTML` and directly interpolates the transaction's `date` and `category` fields. Both fields originate from SQLite records and can contain arbitrary HTML because the record-validation function does not validate dates or restrict custom-category content. A payload such as the following can therefore be s ...[truncated 1943 chars]- Remediation
View remediation