T09 · Insecure Skill Coding Practices
Error
- Location
references/html-template.md:230- Finding
Unescaped Untrusted Data Can Inject Active Content into Generated HTML Reports
- Content
View full analysis
ر.سليش هذا الأفضل لك؟
⚖️ التنازل:اشتري الآن ← ``` The associated rendering instructions state: ```text 2. For each ranked product: if `screenshot_path` exists, read the file and base64-encode it. 3. Generate HTML using the template from html-template.md exactly 4. Save to `shopping-reports/{date}-{query_slug}.html` ``` The template customization instructions additionally require direct substitution: ```text When generating the report, replace all `` with actual data ``` ### Technical Analysis The report renderer inserts product names, prices, descriptions, coupon information, recommendation text, and URLs into HTML contexts. Much of this data originates from untrusted retailer pages, search results, review sites, or user input. No instruction requires: - HTML entity encoding for text nodes. - Attribute encoding for URLs. - Validation of URL schemes. - Rejection of event-handler attributes or active markup. - Sanitization through an allowlist-based HTML sanitizer. - A Content Security Policy restricting script execution. HTML text and attribute contexts require different escaping rules. Directly inserting an attacker-controlled value into `href` could permit a `javascript:` URI. Inserting unescaped data into a text placeholder could terminate the intended element and introduce arbitrary HTML, such as an image with an event handler. The existing rule that product links should point to verified stor ...[truncated 1735 chars]- Remediation
View remediation