T09 · Insecure Skill Coding Practices
Error
- Location
scripts/report_generator.py:112- Finding
Stored HTML Injection in Generated Reports
- Content
View full analysis
小程序可行性决策报告 - {name} ``` They are also rendered directly in the document body: ```python``` The same unsafe interpolation pattern is applied to numerous other externally supplied report fields, including research details, keywords, competitor data, business-model descriptions, promotion strategies, development guidance, and risk descriptions. Representative examples include: ```python📱 {name}
{direction}微信小程序开发可行性决策报告 · {now}{wx_detail}
``` ```python {safe_get(c, 'name', '未知')} {safe_get(c, 'feature', '-')} {safe_get(c, 'users', '-')} ``` ```python{bm_detail}
``` ```python 策略{['一','二','三','四','五','六'][i] if i < 6 else i+1}：{safe_get(st, 'title', '')}{safe_get(st, 'desc', '')}
``` ```python {safe_get(risk, 'name', '')}{safe_get(risk, 'desc', '')}
``` ### Technical Analysis `safe_get()` only checks whether a value is stored in a dictionary. It does not perform HTML escaping, validation, or sanitization. Consequently, `generate_report()` treats product details, command-line JSON input, and web- ...[truncated 2614 chars]- Remediation
View remediation
str: return escape(str(value), quote=True) ``` Apply this function to all scalar values, list entries, and nested dictionary fields rendered in the report: ```python name = escape_text(safe_get(data, "name", "Unnamed product")) direction = escape_text(safe_get(data, "direction", "Unspecified direction")) wx_detail = escape_text(safe_get(wechat_index, "detail", "No detailed data")) ``` 2. Replace manual f-string templating with an autoescaping template engine. For example, use Jinja2 with HTML autoescaping explicitly enabled: ```python from jinja2 import Environment, FileSystemLoader, select_autoescape env = Environment( loader=FileSystemLoader("templates"), autoescape=select_autoescape(["html", "xml"]), ) ``` 3. Keep numeric and presentation values separate from text: - Require scores to be finite integers or floats within the range `0` to `100`. - Validate counts, colors, trend values, and risk levels against strict allowlists. - Do not place arbitrary input into CSS properties or other executable browser contexts. 4. If selected fields must support formatting, sanitize them with a mature HTML sanitizer using a minimal allowlist. Disallow scripts, event-handler attributes, forms, iframes, SVG, embedded objects, external styles, and dangerous URL schemes. 5. Add a restrictive Content Security Policy to generated reports as defense in depth. For a self-contained report, avoid inline JavaScript and block unnecessary outbound communication: ```html ``` A CSP is supplementary protection and must not replace contextual output escaping. 6. Add regression ...[truncated 466 chars]