T09 · Insecure Skill Coding Practices
Error
- Location
scripts/report_generator.py:75- Finding
Persistent HTML and JavaScript Injection in Generated Reports
- Content
View full analysis
{s}' for s in c["suggestions"] ) if c["suggestions"] else "- 文案基本OK
" # Diagnostic finding list findings_items = "".join( f'- {f}
' for f in d["detailed_findings"] ) card = f"""#{idx + 1}{p['product_name']}
价格: ¥{p['product_price']:.2f} | 品类: {p.get('category', '通用')} | 样本: {p['total_users']}人- Remediation
View remediation
{escape(str(item), quote=True)}" for item in c["suggestions"] ) findings_items = "".join( f"- {escape(str(item), quote=True)}
" for item in d["detailed_findings"] ) ``` 2. Do not place data into JavaScript by surrounding an interpolated value with quotes. Serialize the entire value as JSON: ```python product_name_js = json.dumps( str(p["product_name"]), ensure_ascii=False ) ``` Then use it without additional JavaScript quotes: ```javascript label: {product_name_js}, ``` 3. Defend against script-element termination. Because JSON embedded inside an inline `script` element can contain ``, either: - Replace `<` with its Unicode escape form in serialized JavaScript data, or - Place report data in a non-executable JSON element and parse it safely, or - Move report data into an external JSON file loaded by trusted static JavaScript. Example: ```python def safe_json_for_script(value): return json.dumps(value, ensure_ascii=False).replace("<", "\\u003c") ``` 4. Prefer DOM-safe rendering with `textContent` instead of building HTML through string interpolation. 5. Add a restrictive Content Security Policy. Remove inline scripts where possible and use a nonce or hash for trusted code. For example: ```html ` ...[truncated 690 chars]