T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/hotspot_push.py:672- Finding
Stored HTML Injection in Generated Fishing Reports
- Content
View full analysis
{date[-5:] if len(date)>=10 else date}{emoji}{text_day}{temp_low}° / {temp_high}°🌬️ {wind}级""" if fishing_index: fi_cat = fishing_index.get("category", "?") fi_text = fishing_index.get("text", "") fi_level = fishing_index.get("level", "2") fi_colors = {"1": "#22c55e", "2": "#3b82f6", "3": "#f59e0b", "4": "#ef4444"} fi_color = fi_colors.get(fi_level, "#94a3b8") fi_html = f"""{fi_cat} {fi_text}""" hotspot_cards = "" if hotspots: for i, h in enumerate(hotspots[:10]): rank_emoji = ["🥇", "🥈", "🥉", "4️⃣", "5️⃣", "6️⃣", "7️⃣", "8️⃣", "9️⃣", "🔟"][i] species_tags = "" for s in h.get("fish_species", [])[:4]: species_tags += f'🐟 {s}' bait_tags = "" for b in h.get("bait", [])[:3]: bait_tags += f'🪱 {b}' dist_km = h.get("distance_km") dist_str = f"{dist_km}km" if dist_km else "距离未知" sent_map = {"positive": "🟢", "negative": "🔴", "neutral": "🟡"} sent_emoji = sent_map.get(h.get("sentiment", "neutral"), "🟡") score = h.get("score", 50) score_color = h.get("level_color", "#3b82f6") social_badge = "" if h.get("source") == "social": mention = h.get("mention_co ...[truncated 4283 chars]- Remediation
View remediation
str: return escape(str(value), quote=True) ``` Apply this function to the city, display name, POI name, weather fields, fishing-index text, hotspot location, and every other externally sourced value. 2. Construct the Amap navigation URL with URL-encoding rather than string concatenation: ```python from urllib.parse import urlencode from html import escape query = urlencode({ "to": f"{longitude},{latitude},{location_name}" }) navigation_url = escape( f"https://uri.amap.com/navigation?{query}", quote=True, ) ``` 3. Validate values before rendering: - Parse longitude and latitude as finite floating-point values and enforce valid geographic ranges. - Parse scores and widths as bounded integers. - Restrict colors and status values to internal allowlists. - Reject unexpected control characters in externally supplied text. 4. Add a restrictive Content Security Policy to generated reports, for example: ```html ``` If external navigation must remain available, permit only the required navigation behavior without enabling scripts or unrestricted resource loading. 5. Add `rel="noopener noreferrer"` to links opened with `target="_blank"`. 6. Add automated tests that generate reports using payloads in every dynamic field, including: ```html ">javascript:alert(1) ``` The tests should verify that these values appear only as encoded text and never create executable elements, event-handler attributes, or attacker-controlled URL schemes. ]]>