T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:294- Finding
Unescaped Medical Data Allows Active HTML Injection
- Content
View full analysis
REASON FOR REFERRAL{data.reason_for_referral.replace(chr(10), '
``` The same unsafe interpolation pattern also affects patient and provider details, diagnoses, medical history, medications, allergies, vital signs, laboratory results, and additional notes in `scripts/main.py:244-331`. ### Technical Analysis Values loaded from the input JSON are interpolated directly into an HTML document. Replacing newline characters with `
')}
` does not encode HTML metacharacters such as `<`, `>`, `"`, or `&`. An attacker who can influence referral data can therefore insert arbitrary HTML, including script elements, event handlers, external resources, misleading forms, or document-structure-breaking markup. For example, a referral reason containing an image with an `onerror` handler would be written as active markup rather than displayed as text. This issue is especially significant because generated referral documents contain protected health information. If the output is opened directly in a browser, hosted by an internal application, embedded into a web page, or passed into an email workflow, the injected markup may execute under the security context assigned to that document. ### Attack Path 1. An attacker supplies or modifies the input referral JSON. 2. The attacker places active HTML in `reason_for_referral` or another rendered field. 3. `load_from_json()` accepts the value without sanitization. 4. `generate_html()` interpolates the value directly into the document. 5. The generated HTML file is delivered to a healthcare worker or uploaded to another system. 6. When the file is rendered, the attacker-controlled markup executes or modifies the displayed referral. 7. Dependin ...[truncated 921 chars]- Remediation
View remediation
`, ``, malformed closing tags, and encoded HTML entities. ]]>