T09 · Insecure Skill Coding Practices
Error
- Location
scripts/report_generator.py:315- Finding
Stored Cross-Site Scripting in Generated HTML Reports
- Content
View full analysis
{inv['id']}{inv['invoice_date']} {cat_icon} {inv['category']}{inv['invoice_type'][:10]} ¥{inv['total_amount']:,.2f} {inv['seller_name'][:15]} {status_label} """ ``` ```python "__INVOICES_JSON__": json.dumps(invoices, ensure_ascii=False, default=str), ``` ```javascript checks.forEach(function(c) { var inv = invoices.find(function(i) { return i.id == parseInt(c.dataset.id); }); if (!inv) return; total += inv.total_amount; var icon = CATEGORY_ICONS[inv.category] || '📋'; itemsDiv.innerHTML += '' + '' + icon + ' ' + inv.invoice_date + ' | ' + inv.category + ' | ' + (inv.seller_name||'').substring(0,20) + '' + '¥' + inv.total_amount.toLocaleString('zh-CN', {minimumFractionDigits: 2}) + ''; }); ``` ```javascript var itemsHtml = selectedInvoices.map(function(i) { var icon = CATEGORY_ICONS[i.category] || '📋'; return '' + i.invoice_date + '' + icon + ' ' + i.category + '' + i.invoice_number + '' + (i.seller_name||'') + '¥' + i.total_amount.toFixed(2) + ''; }).join(''); var notesHtml = notes ? '备注: ' + notes + '
' : ''; var doc = window.open('', '_blank', 'width=800,height=600'); doc.doc ...[truncated 3476 chars]- Remediation
View remediation
... ``` Escape `<`, `>`, `&`, U+2028, and U+2029 before embedding, then parse the element's `textContent`. 4. Validate enumerated fields such as category and status against strict server-side allowlists. 5. Escape reimbursement reason and notes before placing them in a printable document. 6. Add a restrictive Content Security Policy that disallows inline scripts and unauthorized network destinations. 7. Add regression tests using payloads containing HTML attributes, event handlers, quotes, and ``. ]]>