T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cost_optimizer.py:396- Finding
Stored cross-site scripting in generated cost reports
- Content
View full analysis
", ">") html += f""" {i} {text}... {q['bytes_formatted']} {q.get('duration_sec', 'N/A')}s {q['user']} """ ``` ### Technical Analysis The `user` or `user_email` field originates in the supplied query-log JSON and is interpolated directly into the generated HTML. No HTML escaping is applied to this value. The query text receives limited replacement of angle brackets, but this is not a general contextual-escaping mechanism. Other input-controlled fields, including `user` and potentially `duration`, are rendered without validation. An attacker can supply a value containing an HTML element with an event handler, such as an image whose `onerror` handler executes JavaScript. The resulting payload is stored in the generated report and runs when the report is opened. ### Attack Path 1. An attacker supplies or modifies a query-log JSON file. 2. A query record contains a malicious `user` or `user_email` value. 3. The operator runs `cost_optimizer.py ...[truncated 692 chars]- Remediation
View remediation
`. - Add a restrictive Content Security Policy that disallows inline scripts and limits script sources. - Add regression tests containing event handlers, quotes, malformed tags, and `` sequences. ]]>