T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:612- Finding
Unescaped Sample Identifiers Enable Stored HTML Injection
- Content
View full analysis
pd.DataFrame: """Load OTU table""" df = pd.read_csv(path, sep='\t', index_col=0, comment='#') # Transpose so that samples are rows and OTUs are columns if df.shape[0] > df.shape[1]: df = df.T return df ``` Those identifiers are subsequently inserted into the generated HTML without output encoding: ```python for sample, coords in pcoa['samples'].items(): html_content += f""" {sample} {coords['PC1']:.3f} {coords['PC2']:.3f} {coords['PC3']:.3f} """ ``` ### Technical Analysis The sample identifier is controlled by the contents of the user-supplied OTU/ASV table. It propagates from the DataFrame index into an HTML f-string without contextual escaping or sanitization. HTML generation must encode untrusted text before placing it into an HTML document. Because the value is inserted directly between `` tags, an identifier containing HTML elements or event handlers is interpreted as markup rather than displayed as plain text. For example, a sample identifier could contain: ```html``` The generated report would preserve that value as an active HTML element. When the report is opened in a browser, its event handler can execute in the report's browser context. ### Attack Path 1. An attacker creates or modifies an OTU/ASV TSV file. 2. The attacker places an HTML or JavaScript payload in a sample identifier. 3. A user runs the tool with the mali ...[truncated 1097 chars]
- Remediation
View remediation
{safe_sample} {coords['PC1']:.3f} {coords['PC2']:.3f} {coords['PC3']:.3f} """ ``` A stronger long-term approach is to use an HTML template engine with automatic escaping enabled. All values derived from OTU tables, metadata, labels, column names, and future user-configurable fields should be treated as untrusted. Add regression tests that generate reports using identifiers containing: - `