T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_report.py:41- Finding
Stored HTML and JavaScript Injection in Generated Reports
- Content
View full analysis
{i+1}{r}' for i, r in enumerate(responsibilities) ) hard_req_tags = "".join( f'{s}' for s in hard_skills_required ) hard_plus_tags = "".join( f'{s}' for s in hard_skills_plus ) soft_tags = "".join( f'{s}' for s in soft_skills ) ``` At lines 92-95, explicit and implicit requirement fields are interpolated without escaping: ```python rows += f""" {explicit} → {implicit} {render_signal_badge(strength)} """ ``` At lines 278-289, learning-roadmap fields are also rendered as raw HTML: ```python items_html = "".join(f"- {item}
" for item in p.get("items", [])) projects = p.get("projects", "") phase_cards += f"""""" ``` At lines 310-318, ATS keywords and integration advice are rendered without escaping: ```python tags = "".join(f'{k}' for k in items) sections += f"""第 {phase_num} 阶段 ⏱ {duration}{title}
- {items_html}
🛠 实战项目：{projects}' if projects else ''}""" tips = "".join( f"{cat}
{tags}- {t}
" for t in data.get("module_7_integration_tips", []) ) ...[truncated 3496 chars]- Remediation
View remediation
str: return escape(str(value), quote=True) ``` Use `safe_text()` for all text inserted into HTML, SVG text, titles, labels, list items, table cells, and attributes. 2. Prefer a template engine with automatic escaping, such as Jinja2 with autoescaping enabled, rather than constructing the document with large f-strings. 3. Validate the complete JSON structure before rendering: - Require expected object, array, string, and numeric types. - Reject unexpected nested markup. - Enforce documented numeric ranges. - Limit field and collection lengths to prevent resource exhaustion. 4. If limited rich-text support is required, sanitize it with a strict allowlist. Do not allow scripts, event-handler attributes, active SVG elements, iframes, object elements, or dangerous URL schemes. 5. Add a restrictive Content Security Policy, preferably through an HTTP header when served or a compatible HTML meta policy: ```html ``` The existing inline script should be moved into a trusted external file or replaced with nonce/hash-based authorization so that `unsafe-inline` is not required for scripts. 6. Add regression tests that provide payloads in every schema string field and verify that the generated document contains encoded text such as `<` rather than executable markup. ]]>