T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_report.py:154- Finding
Unescaped Remote and Narrative Data Enables HTML Injection
- Content
View full analysis
{p['name']}
{p.get('source','').split(':')[0]}" for p in peers ) peer_row = lambda fn: "".join(f"{fn(p)}" for p in peers) biz_rows = "" products = mbiz.get("by_product") or mbiz.get("by_industry") or [] for item in products[:5]: ratio = (item.get("revenue_ratio") or 0) * 100 if ratio < 1 and "其他" in item.get("item", ""): continue rev_yi = (item.get("revenue") or 0) / 1e8 gm = (item.get("gross_margin") or 0) * 100 biz_rows += ( f"{item['item']}{rev_yi:.2f}" f"{ratio:.1f}%{gm:.2f}%" ) cat_html = "" for c in n.get("catalysts", []): cat_html += ( f"- {c['title']} " f"{impact_badge(c.get('impact','中'))}：{c['desc']}
" ) risk_html = "" for r in n.get("risks", []): risk_html += ( f"- {r['title']} " f"{impact_badge(r.get('impact','中'))}：{r['desc']}
" ) ``` ```python # Representative output sinks from lines 316-496{n.get('company_comment','')}
{n.get('price_position','')}
按地区：{n.get('region_summary','-')}
{n.get('business_comment','')}
-
{"".join(f"
- {f} " for f in n.get('peer_findings', []))}
- {cat_html}
- {risk_html}
{n.get('overall_judgment','')}
``` ### Technical Analysis The report generator constructs an HTML document using Python f-strings and directly in ...[truncated 2455 chars]- Remediation
View remediation
``` 7. Add regression tests containing `