T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:383- Finding
Unescaped User Input Is Inserted into Executable HTML Reports
- Content
View full analysis
Java后端开发...` | | `{{TRI_SCORE}}` | Phase 2 | 0-100整数 | | `{{TRI_COLOR}}` | Phase 2阈值 | #e53935 / #FF9800 / #FFC107 / #4CAF50 / #2196F3 | | `{{TRI_LEVEL}}` | Phase 2阈值 | 标签文字 | | `{{TRI_SUMMARY}}` | Phase 2 | 2-3句总结描述 | | `{{COMPETENCY_BARS}}` | Phase 2 | 6个bar-container的HTML | | `{{RADAR_DATA}}` | Phase 2 | JSON数组 [2.8, 3.5, 2.0, ...] | | `{{RADAR_TARGET}}` | Phase 3 Top方向要求 | JSON数组 | | `{{DIRECTION_CARDS}}` | Phase 3 | 前6-8个方向卡片的HTML | | `{{TOP_DIRECTION}}` | Phase 3 | 匹配度最高的方向名 | | `{{GAP_ANALYSIS_ROWS}}` | Phase 4 | 6行的HTML table rows | | `{{QUARTERLY_PLAN}}` | Phase 5 | 4个timeline-quarter的HTML | | `{{LEARNING_RESOURCES}}` | 根据Top方向生成 | 4-6个resource-item的HTML | | `{{RISK_WARNINGS}}` | 全局分析 | 3-5个warning-box的HTML | ``` Those values are inserted into active HTML contexts without any documented escaping or sanitization: ```html 计算机行业转行规划报告 - {{REPORT_TITLE}} ``` ```html{{PROFILE_TAGS}}``` ```html{{TRI_SUMMARY}}
``` ```html{{DIRECTION_CARDS}}``` ```html {{GAP_ANALYSIS_ROWS}} ``` ```html{{QUARTERLY_PLAN}}``` ```html- Remediation
View remediation
` as `>` - `"` as `"` - `'` as `'` 2. Do not construct HTML fragments by concatenating questionnaire answers. Use a template engine with automatic escaping or create elements through safe DOM APIs such as `textContent`. 3. Treat each placeholder according to its context: - Escape `REPORT_TITLE`, `REPORT_DATE`, `TRI_LEVEL`, `TRI_SUMMARY`, and `TOP_DIRECTION` as text. - Validate `TRI_SCORE` as an integer in the range 0-100. - Validate radar data as finite numeric arrays with exactly six entries in the range 0-5. - Allowlist color values rather than accepting arbitrary CSS. - Sanitize intentionally generated HTML fragments with a strict allowlist. 4. Add a restrictive Content Security Policy. Prefer a policy that blocks inline scripts and event handlers, such as: ```html ``` 5. Add automated tests using payloads that attempt to escape title, text, table, attribute, JSON, CSS, and script contexts. Confirm that generated reports display payloads as text rather than executing them. ]]>