T09 · Insecure Skill Coding Practices
Warning
- Location
references/repair-template.md:189- Finding
Unescaped User-Controlled Content in Generated HTML Reports
- Content
View full analysis
Fault symptom{description} Diagnostic conclusion{conclusion} Confidence{high/medium/low} SeverityP{N} ``` ```html``` The associated report-generation instructions state, in substance: ```text 1. Replace the placeholders in the template with actual diagnostic content. 2. Delete an unneeded report card where applicable. 3. The safety-warning card may be deleted when there is no P0/P1 risk. 4. Save the generated HTML file to the working directory for the user to save or print. ``` Other affected interpolation points include the HTML title and heading at lines 106 and 180, and repair-step placeholders at lines 207 and 224. ### Technical Analysis The report template places dynamic diagnostic values directly into HTML element content. These values may be derived from user-controlled fields such as the device name and fault description. The generation instructions require direct placeholder replacement but do not require HTML escaping, sanitization, validation, or use of a template engine with automatic contextual encoding. An attacker can provide input containing HTML elements or event-handler attributes. If that input is inserted verbatim, it becomes active markup rather than inert report text. For example, an image element with an error event handler could execute J ...[truncated 1840 chars]Safety Information
{safety warning content}- Remediation
View remediation
``` 6. Do not permit remote scripts, remote stylesheets, embedded frames, forms, or external resource loading in generated reports. 7. Add security tests using payloads containing angle brackets, event handlers, script elements, encoded markup, malformed tags, and attribute-breaking characters. 8. Prefer plain-text or safely generated PDF reports when secure HTML rendering cannot be guaranteed. 9. Update the report-generation instructions to state explicitly that every placeholder value must be contextually encoded before insertion. ]]>