T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_invoice.py:27- Finding
Stored HTML and JavaScript Injection in Generated Invoices
- Content
View full analysis
{item['description']} {qty:g} {currency_symbol}{unit_price:,.2f} {currency_symbol}{amount:,.2f} """) return "\n".join(rows) ``` ```python replacements = { "{{INVOICE_ID}}": invoice_data.get("id", "INV-000000"), "{{STATUS}}": status.upper(), "{{STATUS_CLASS}}": status, "{{ISSUE_DATE}}": issue_date, "{{DUE_DATE}}": invoice_data.get("due_date", ""), "{{BUSINESS_NAME}}": invoice_data.get("business_name", "Your Business"), "{{BUSINESS_ADDRESS}}": invoice_data.get("business_address", ""), "{{BUSINESS_EMAIL}}": invoice_data.get("business_email", ""), "{{CLIENT_NAME}}": invoice_data.get("client_name", ""), "{{CLIENT_ADDRESS}}": invoice_data.get("client_address", ""), "{{CLIENT_EMAIL}}": invoice_data.get("client_email", ""), "{{ITEMS_ROWS}}": generate_item_rows(invoice_data.get("items", []), currency_symbol), "{{SUBTOTAL}}": f"{invoice_data.get('subtotal', 0):,.2f}", "{{TAX_RATE}}": f"{invoice_data.get('tax_rate', 0):g}", "{{TAX_AMOUNT}}": f"{invoice_data.get('tax_amount', 0):,.2f}", "{{TOTAL}}": f"{invoice_data.get('total', 0):,.2f}", "{{CURRENCY_SYMBOL}}": currency_symbol, "{{PAYMENT_TERMS}}": invoice_data.get("payment_terms", "Net 30"), "{{NOTES}}": invoice_data.get("notes", "Thank you for your business!"), "{{GENERATED_DATE}}": datetime.now().strftime("%B %d, %Y at %I:%M %p"), "{{BRAND_COLOR}}": ...[truncated 2653 chars]- Remediation
View remediation
``` 7. Add regression tests using payloads containing `