T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/generate_report.py:65
- Finding
- Stored HTML and JavaScript Injection in Generated Reports<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_report.py:65-74`, `scripts/generate_report.py:116-126`, and `scripts/generate_report.py:324-338, 401-587` **Vulnerability Type**: Stored cross-site scripting through unsafe HTML generation **Risk Level**: High ### Vulnerable Code ```python data_json = json.dumps({ "query": query, "products": products[:10], "total_reviews": total_reviews, "avg_rating": avg_rating, "rating_dist": _rating_distribution(ratings), "sentiment_dist": sentiments, "keyword_data": keyword_data, "voc_data": _simplify_voc(voc_data), "competitor_data": _simplify_competitor(competitor_data), "opportunity_data": opportunity_data, }, ensure_ascii=False) ``` ```python return f"""<!DOCTYPE html> <html lang="zh-CN"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Amazon产品研究报告: {query}</title> <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.0/dist/chart.umd.min.js"></script> ``` ```javascript const RAW_DATA = {data_json}; (function() { const grid = document.getElementById('productGrid'); const products = RAW_DATA.products || []; products.forEach(p => { const card = document.createElement('div'); card.className = 'product-card'; card.innerHTML = ` <img src="${p.image_url || 'https://via.placeholder.com/300x300/EEE/999'}" alt="${p.title}" onerror="this.src='https://via.placeholder.com/300x300/EEE/999?text=No+Image'"> <div class="title">${p.title}</div> <div class="stars">${'⭐'.repeat(Math.round(p.rating || 0))} ${p.rating}</div> <div class="price">${p.price || 'N/A'}</div> <div class="meta">${(p.total_reviews || 0).toLocaleString()} 条评论</div> <a href="${p.url}" target="_blank">查看详情 →</a> `; grid.appendChild(card); }); })(); ``` ```javascript document.getElementById('kwSummary').innerHTML = kd.summary || ''; document.getElementById('vocSummary').innerHTML = ...[truncated 2736 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Never insert untrusted strings through `innerHTML`. Build elements with `document.createElement()` and assign textual values through `textContent`. 2. Store serialized data in a non-executable `<script type="application/json">` element and parse its `textContent`. 3. Before embedding JSON in HTML, escape at least `<`, `>`, `&`, U+2028, and U+2029. For example, replace `<` with `\u003c`. 4. Apply HTML attribute escaping to direct template substitutions such as the query and market. 5. Validate all URLs with `urllib.parse.urlparse()` and allow only expected HTTPS origins. Reject `javascript:`, `data:`, `file:`, and unexpected hosts. 6. Validate LLM responses against a strict schema with type, size, and character constraints. 7. Add a restrictive Content Security Policy that disallows inline scripts and limits network connections, images, and scripts to approved sources. 8. Add regression tests containing payloads in queries, titles, reviews, summaries, URLs, and all LLM-generated fields. ]]>