T09 · Insecure Skill Coding Practices
Error
- Location
scripts/reconcile.py:762- Finding
Stored Cross-Site Scripting in Generated HTML Reports
- Content
View full analysis
= 90 else "#eab308" if match_score >= 70 else "#f97316" match_info = f'{match_type_cn} ({match_score}分)' if show_book_ref and r.get('match_id'): match_info += f' → {r["match_id"]}' rows += f""" {i+1} {date_str} {amount_str} {desc} {cp} {match_info} """ ``` ```python matched_rows_html += f""" {i+1} {m["bank_date"]} {m["bank_amount"]:,.2f} {m["bank_desc"]} {m["book_date"]} {m["book_amount"]:,.2f} {m["book_desc"]} {m["type_cn"]} {m["score"]} """ ``` ```python const data = {json.dumps({"unmatched_bank": serialized["unmatched_bank"], "unmatched_book": serialized["unmatched_book"]}, ensure_ascii=False)}; ``` ### Technical Analysis The report generator directly interpolates transaction fields originating from imported Excel or CSV files into HTML text nodes, HTML attributes, and an inline JavaScript block. Truncating a value does not make it safe. For example, a description ...[truncated 2303 chars]- Remediation
View remediation
{i + 1} {safe_date} {amount_str} {safe_desc} {safe_cp} {match_info} """ ``` 2. Do not place attacker-controlled JSON directly inside an executable inline script. Prefer a non-executable JSON element: ```html ``` Before embedding JSON, replace HTML-significant characters, particularly `<`, with Unicode escapes such as `\u003c`. Parse the content using `JSON.parse(document.getElementById('unmatched-data').textContent)`. 3. Alternatively, write the export data to a separate local JSON file and load or download it without embedding it in executable JavaScript. 4. Add a restrictive Content Security Policy, preferably disallowing inline scripts and event handlers. Move the report JavaScript into a fixed script file with a hash or nonce if necessary. 5. Add regression tests covering malicious values in every imported field, including: - Quotes and angle brackets. - Attribute-breaking payloads. - `` sequences. - Event-handler payloads such as `onerror`. - Unicode and malformed input. ]]>