T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:89- Finding
Unescaped CLI Input Allows HTML Injection and Stored Cross-Site Scripting
- Content
View full analysis
临床试验Dashboard - {args.study_id} ``` ```python📊 {args.study_name}
🔬 研究编号: {args.study_id} ``` The affected values originate from command-line arguments: ```python parser.add_argument("--study-id", default="STUDY-001", help="研究编号") parser.add_argument("--study-name", default="临床试验 A", help="研究名称") ``` ### Technical Analysis The `--study-id` and `--study-name` arguments are inserted directly into an HTML document through Python f-string interpolation. No HTML escaping, sanitization, or context-aware output encoding is applied. An attacker can supply HTML containing elements, event handlers, or script markup. For example, a value that terminates the title element and introduces a script element would become executable content in the generated dashboard. The vulnerability is persistent within the generated file because the payload is written to disk and runs whenever that file is opened in a browser. This issue crosses a trust boundary when dashboard parameters are supplied by an untrusted user, imported from automation, or copied from an external source. ### Attack Path 1. An attacker controls or influences the value passed to `--study-id` or `--study-name`. 2. The attacker supplies an HTML payload, for example: ```bash python scripts/main.py \ --study-id '' \ --output dashboard.html ``` 3. `generate_html()` inserts the payload into the generated HTML without escaping it. 4. The script writes the malicious document to `dashboard.html`. 5. A user opens the generated dashboard in a browser. 6. The browser parses and executes the attacker-controlled JavaScript in the ...[truncated 770 chars]- Remediation
View remediation
Clinical Trial Dashboard - {safe_study_id}📊 {safe_study_name}
🔬 Study ID: {safe_study_id} ``` Additional hardening should include: 1. Prefer a template engine with automatic HTML escaping enabled. 2. Apply context-aware encoding separately for HTML text, HTML attributes, JavaScript, CSS, and URLs. 3. Validate identifiers against a restrictive allowlist where practical, such as letters, digits, spaces, hyphens, and underscores. 4. Add automated tests using payloads containing `