T09 · Insecure Skill Coding Practices
Error
- Location
scripts/report_generator.py:296- Finding
Unescaped Input Enables Persistent HTML and JavaScript Injection in Generated Reports
- Content
View full analysis
🔍 一、搜索热度分析
{make_score_bar(sh_score)}搜索趋势{trend_icon} {sh_trend}月搜索量{sh_volume}{sh_detail}
""" if sh_keywords: html += '关联关键词： ' for kw in sh_keywords: html += f'{kw} ' html += '' ``` The CLI accepts JSON data without applying output encoding: ```python data = { "name": args.name, "category": args.category, ...[truncated 3414 chars]- Remediation
View remediation
{html_text(kw)}' html += f'{html_text(sh_detail)}
' ``` 2. Prefer an auto-escaping template engine such as Jinja2 instead of manually constructing HTML with f-strings: ```python from jinja2 import Environment, select_autoescape env = Environment(autoescape=select_autoescape(["html", "xml"])) template = env.from_string(template_source) html = template.render(**data) ``` Do not use a template engine's `safe` filter for web-search or user-controlled data. 3. Validate data types and ranges before rendering. In particular: - Require scores to be finite numeric values. - Restrict scores to the range `0` through `100`. - Require expected list and object fields to have the documented structure. - Reject unexpectedly nested objects where plain text is required. - Limit field lengths to prevent excessively large output. 4. Keep trusted presentation markup separate from untrusted report content. Dynamic values should be treated as plain text unless a field explicitly requires sanitized rich text. 5. If rich HTML must be supported, sanitize it with a maintained allowlist-based HTML sanitizer. Allow only required elements and attributes, and reject scripts, event-handler attributes, dangerous URLs, embedded frames, and active content. 6. Add automated security tests covering: - `