T09 · Insecure Skill Coding Practices
Error
- Location
scripts/report_generator.py:117- Finding
Stored HTML and Script Injection in Generated Reports
- Content
View full analysis
鸿蒙原生应用可行性决策报告 - {name} ``` ```python🦋 {name}
{direction}``` ```python eco_detail = safe_get( ecosystem, "detail", "鸿蒙已成为中国第二大移动操作系统，市场份额达18%。" "\"纯血\"鸿蒙设备从2025年11月的2300万台增长到2026年初的" "5100万台，4个月内翻倍，增长速度行业最快。" "华为每年投入60亿元激励开发者，生态正处价值洼地。" ) ``` ```python{eco_detail}
``` ```python comp_detail = safe_get(competitors, "detail", "暂无详细数据") ``` ```python{comp_detail}
``` The resulting document is subsequently written to disk: ```python output_path = Path(args.output) output_path.parent.mkdir(parents=True, exist_ok=True) output_path.write_text(html, encoding="utf-8") ``` ### Technical Analysis `safe_get()` only retrieves values from dictionaries and does not perform HTML escaping, sanitization, or type validation. Product names, descriptions, web-derived research data, competitor information, and other caller-controlled fields are inserted directly into HTML element and metadata contexts. An attacker can supply markup that closes the current element and introduces an executable element or event handler. For example, a malicious product name could contain: ```html ``` Other fields inserted into body elements could contain event-handler payloads such as: ```html <img src=x onerror="/* attacker-controlled JavaScript */"> ``` Because the payload is persisted in the generated file, it executes when a user opens that ...[truncated 1601 chars]- Remediation
View remediation
``` This policy should be tested against required report functionality. Avoid enabling scripts, remote resources, inline event handlers, or form submission unless they are strictly required. 6. Add regression tests containing payloads in every supported input field. Verify that characters such as `<`, `>`, `&`, `"`, and `'` are encoded and that no executable elements or event-handler attributes appear in the resulting document. ]]>