T09 · Insecure Skill Coding Practices
Error
- Location
scripts/scanner.py:685- Finding
Stored JavaScript Injection in Generated HTML Reports
- Content
View full analysis
const reportData = {{REPORT_DATA}}; const shell = reportData.shell_type || 'bash'; ``` ### Technical Analysis The report contains filesystem-derived values, including file names, directory paths, usernames, hostnames, and artifact paths. These values are serialized with `json.dumps()` and inserted directly into an HTML `` terminates an HTML script element even when the sequence appears inside a valid JavaScript string. Consequently, an attacker-controlled file or directory name such as the following can escape the report's script block: ```text ``` The report is automatically opened by `scanner.py`, making exploitation possible immediately after scanning: ```python webbrowser.open(f"file://{report_path}") ``` Escaping values later with `escHtml()` does not prevent this vulnerability because execution occurs while the browser initiall ...[truncated 1722 chars]- Remediation
View remediation
{{REPORT_DATA}} ``` 3. Before embedding the serialized JSON, escape HTML-significant characters: ```python report_json = json.dumps(all_data, ensure_ascii=False) report_json = ( report_json .replace("&", "\\u0026") .replace("<", "\\u003c") .replace(">", "\\u003e") .replace("\u2028", "\\u2028") .replace("\u2029", "\\u2029") ) ``` 4. Parse the non-executable data explicitly: ```javascript const reportData = JSON.parse( document.getElementById('report-data').textContent ); ``` 5. Add a restrictive Content Security Policy that prohibits network access and unauthorized script execution. For a self-contained report, consider: ```html ``` Prefer moving JavaScript to a separately packaged local file so that `unsafe-inline` is not required for scripts. 6. Add regression tests using file names containing ``, HTML tags, quotes, backticks, Unicode separators, and multiline content. 7. Avoid automatically opening the report until report generation and validation complete successfully. ]]>