T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_report.py:89- Finding
Stored HTML and JavaScript Injection in Generated Reports
- Content
View full analysis
暂无" color = "#993C1D" if tag_type == "issue" else "#27500A" bg = "#FAECE7" if tag_type == "issue" else "#EAF3DE" html = "" for item in items: html += f'{item}' return html ``` ```python def render_priority_list(items, p_level): if not items: return f'暂无 {p_level} 级问题
' color_map = {"P0": "#E24B4A", "P1": "#BA7517", "P2": "#378ADD"} bg_map = {"P0": "#FCEBEB", "P1": "#FAEEDA", "P2": "#E6F1FB"} color = color_map.get(p_level, "#378ADD") bg = bg_map.get(p_level, "#E6F1FB") html = "" for i, item in enumerate(items, 1): html += f"""{p_level} {item}""" return html ``` ```python # key findings key_findings = data.get("key_findings", []) findings_html = "" for f in key_findings: findings_html += f'- {f}
' if not findings_html: findings_html = '- 暂无核心发现
' ``` ```python sc_html = f"""- Remediation
View remediation
' f'{safe_value}' ) ``` Reject or render as plain text URLs using `javascript:`, `data:`, `file:`, or other unexpected schemes. 3. Enforce a strict input schema before report generation. Validate: - Expected object, array, string, and numeric types. - Score and maximum-score ranges. - Maximum string and array lengths. - Allowed grade, platform, and competition values. - URL format and scheme. 4. Keep text and markup generation separate. Prefer a template engine with automatic escaping enabled rather than constructing HTML through raw f-string interpolation. 5. Add a restrictive Content Security Policy as defense in depth, for example: ```html ``` The policy should be tested against the report's legitimate functionality. It must supplement, not replace, correct escaping and validation. 6. Add regression tests using payloads such as: ```text