T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_report.py:260- Finding
Stored HTML and Script Injection in Generated Reports
- Content
View full analysis
str: records = dns_data.get("records", {}) errors = dns_data.get("errors", []) if not records and errors: return "".join(f'{e}' for e in errors) rows = "" for rtype in ["A", "AAAA", "NS", "MX", "CNAME", "TXT", "SOA", "CAA", "SRV", "PTR"]: vals = records.get(rtype) if vals is None and rtype == "A": rows += f'{rtype}NXDOMAIN — domain does not exist' break if vals is None: continue if vals: display = vals[:3] extra = f" (+{len(vals) - 3} more)" if len(vals) > 3 else "" rows += f""" {rtype} {len(vals)} record(s) {", ".join(display)}{extra} """ else: rows += f""" {rtype} — No records """ return f""" {rows}
""" ``` The same unsafe interpolation pattern also appears in report fields at lines 50, 109, 193, 208, 304, 339, 352, and 435, including the domain, highlights, availability findings, RDAP entities, WHOIS er ...[truncated 2360 chars]Type Count Values - Remediation
View remediation
str: return escape(str(value), quote=True) ``` 2. Escape all DNS, RDAP, WHOIS, error, domain, subdomain, certificate, and summary values. Use `quote=True` for values placed in attributes. 3. Prefer a maintained template engine with automatic escaping enabled rather than manually constructing HTML with f-strings. 4. Validate imported JSON against a strict schema, including expected types, maximum string lengths, and permitted fields. 5. Add a restrictive Content Security Policy, for example by disallowing inline scripts and event handlers. Move the existing inline tab script into a separately generated static script if necessary. 6. Add regression tests covering payloads in text and attribute contexts, including: ```text" onmouseover="alert(1) ``` 7. Treat escaping as a defense required at the final HTML output boundary, even when upstream data has already been validated. ]]>