T09 · Insecure Skill Coding Practices
Error
- Location
assets/report-template.html:460- Finding
Stored DOM-Based Cross-Site Scripting Through Unsanitized Report Data
- Content
View full analysis
p.category === filter); const grid = document.getElementById('productGrid'); const empty = document.getElementById('emptyState'); if (filtered.length === 0) { grid.innerHTML = ''; empty.style.display = 'block'; return; } empty.style.display = 'none'; grid.innerHTML = filtered.map((p, i) => `#${i + 1} ${p.sourceIcon || '🔗'} ${p.source}${p.innovationLevel ? '' + p.innovationLevel + '' : ''} ${p.name}
${p.tagline}
${p.category} ${p.difficulty ? `难度:${p.difficulty}` : ''} ${p.monetization ? `💰 ${p.monetization}` : ''} ${p.timeToMVP ? `⏱ ${p.timeToMVP}` : ''}${p.metrics ? `${p.metrics.upvotes ? `👍 ${p.metrics.upvotes}` : ''} ${p.metrics.stars ? `⭐ ${p.metrics.stars}` : ''} ${p.metrics.comments ? `💬 ${p.metrics.comments}` : ''}- Remediation
View remediation
``` Serialize it with a proper JSON serializer, escape `<`, `>`, `&`, U+2028, and U+2029, and parse the node's `textContent` at runtime. 5. Add a restrictive Content Security Policy that blocks inline event handlers and limits script and network sources. A nonce- or hash-based policy is preferable to allowing arbitrary inline scripts. 6. Validate the report data schema before rendering. Enforce expected primitive types, bounded lengths, numeric ranges, and known enumeration values. 7. Add security regression tests that place markup, quote-breaking strings, event handlers, and script-closing sequences in every externally sourced field and verify that they render only as text. ]]>