T09 · Insecure Skill Coding Practices
Error
- Location
scripts/report_builder.py:490- Finding
Stored HTML and JavaScript Injection in Generated Compliance Reports
- Content
View full analysis
{m.get("clause_id", "")} {m.get("section", "")} {m.get("content", "")} {badge} {risk_label} {m.get("finding", "")} ''' ``` Additional values are inserted into both HTML text and attribute contexts: ```python review_rows = "" categories = set() for r in reviews: cat = r.get("category", "技术参数") categories.add(cat) comp = r.get("compliance", "N/A") badge = _compliance_badge(comp) stds = r.get("applicable_standards", []) std_text = "; ".join(stds[:2]) if stds else "—" clause = r.get("clause", {}) review_rows += f''' {r.get("clause_id", "")} {clause.get("section", "")} {clause.get("content", "")[:100]}{"..." if len(clause.get("content","")) > 100 else ""} {cat} {std_text} {badge} {r.get("finding", "")[:150]} ''' # Category filter options category_options = "" for cat in sorted(categories): category_options += f'{cat}' ``` Gap-analysis data is handled in the same unsafe manner: ```python for g in gaps: priority = g.get("priority", "P3") comp = ...[truncated 4353 chars]- Remediation
View remediation
str: return escape(str(value or ""), quote=True) ``` Apply this helper to clause identifiers, sections, content, findings, categories, standards, risk labels, remediation text, project metadata, and all other externally derived strings. 2. **Validate fields that should be enumerations.** Do not accept arbitrary values for fields such as compliance state, project type, grade color, priority, and category. Map recognized values to fixed internal representations and reject or safely replace unknown values. ```python ALLOWED_COMPLIANCE = {"PASS", "PASS*", "UNCERTAIN", "FAIL", "MISSING", "N/A"} comp = raw_comp if raw_comp in ALLOWED_COMPLIANCE else "N/A" ``` 3. **Escape attribute contexts explicitly.** Values used in `data-*`, `value`, `class`, and style attributes must not be inserted directly. Use quoted, HTML-escaped values and restrict class or numeric values to allowlisted formats. 4. **Use a template engine with automatic escaping.** Replace manual formatted-string construction and `str.replace()` templating with an autoescaping template engine such as Jinja2 configured for HTML output. Avoid marking externally derived content as safe. 5. **Constrain numeric presentation values.** Values used for dimensions such as CSS width should be parsed as numbers and clamped to an expected range: ```python rate = max(0.0, min(100.0, float(rate))) ``` 6. **Add a restrictive Content Security Policy as defense in depth.** Refactor inline JavaScript and styles where practical, then add a policy that disallows inline event handlers and unapproved network destinations. CSP must supplement, not replace, correct output encoding. 7. **Add regression tests for injection payloads.** Test every r ...[truncated 399 chars]