T09 · Insecure Skill Coding Practices
Error
- Location
references/card-template.html:350- Finding
Unescaped user-controlled content permits persistent HTML and script injection
- Content
View full analysis
NO.{{NUMBER}}{{TAG}}{{TITLE}}{{SUBTITLE}}{{BODY_CONTENT}} {{QUOTE_BLOCK}}{{MECHANISM_BLOCK}}{{SUMMARY}}
``` ### Technical Analysis The Skill accepts user-provided material, including structured JSON or YAML, and transforms it into `cardData`. The resulting values are inserted into an HTML document through direct string replacement. No instruction requires HTML entity encoding, attribute encoding, URL validation, or sanitization of active HTML. Although `MECHANISM_BLOCK`, `BODY_CONTENT`, and `QUOTE_BLOCK` intentionally contain generated markup, the user-derived text embedded inside those blocks ...[truncated 2088 chars]BY {{AUTHOR}}
- Remediation
View remediation
` as `>` - `"` as `"` - `'` as `'` 2. Treat `TAG`, `TITLE`, `SUBTITLE`, `SUMMARY`, `AUTHOR`, action fields, comparison fields, mechanism text, and quote text strictly as plain text. 3. Construct the optional structural blocks exclusively from trusted, fixed templates. Escape each nested text value before adding it to those blocks. 4. Enforce strict allowlists: - `body_type`: `process`, `compare`, or `concept` - `color`: `red`, `yellow`, `green`, `blue`, or `purple` - `tag`: only the documented tag values - `number`: exactly three decimal digits - `step`: only the supported step symbols 5. Prefer DOM construction with `textContent` over HTML string concatenation when implementation constraints permit. 6. Add a restrictive Content Security Policy after removing remote executable dependencies. For a fully self-contained static card, consider: ```html ``` 7. Do not automatically preview the output until validation and sanitization have completed successfully. 8. Add regression tests containing payloads in every user-controlled field, including: ```html``` ]]>