T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/render_report.py:6- Finding
Unescaped Markdown and HTML Content Injection in Report Rendering
- Content
View full analysis
str: lines = ["# Financial Report Analysis", ""] comp = result.get("company") or {} period = result.get("period") or {} lines.append(f"**Company:** {comp.get('name','?')} ") lines.append(f"**Period:** FY{period.get('fiscal_year','?')} ({period.get('reporting_basis','?')})") lines.append("") if "executive_summary" in result: lines.append("## Executive Summary"); lines.append(""); lines.append(result["executive_summary"]); lines.append("") if "ratios" in result: lines.append("## Key Ratios"); lines.append("") for group, vals in result["ratios"].items(): lines.append(f"### {group}") for k, v in vals.items(): pct = f"{v*100:.2f}%" if isinstance(v, float) and -10 < v < 10 else str(v) lines.append(f"- **{k}**: {pct}") lines.append("") if "red_flags" in result: lines.append("## Red Flags"); lines.append("") if not result["red_flags"]: lines.append("_None detected._") for f in result["red_flags"]: lines.append(f"- {f['severity']} **{f['code']}** {f['title']} — {f['evidence']}") return "\n".join(lines) ``` ### Technical Analysis The renderer directly interpolates fields from an input JSON document into Markdown without validating their types or escaping Markdown and raw HTML syntax. Affected fields include the company name, reporting period, executive summary, ratio group and key names, and every red-flag property. Markdown supports structural directives, links, images, and, depending on the downstream renderer, raw HTML. Consequently, an attacker can place Markdown or HTML markup and newline characters in one of these fields to alter ...[truncated 1834 chars]- Remediation
View remediation