T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_report.py:48- Finding
Unescaped Upstream Data Allows Markdown and HTML Content Injection
- Content
View full analysis
= 4][:3] if high_impact_events: for i, evt in enumerate(high_impact_events[:2]): sectors_str = "/".join(evt.get('related_sectors', ['综合'])) lines.append(f"### 🎯 结论{i+1}：{evt['title'][:50]}") lines.append(f"**核心催化：** {evt['title']}") ``` Additional affected output operations include: ```python lines.append(f"| 10Y国债收益率 | {b.get('value','-')}% | {b.get('weekly_change',0):+.0f}bp | {b.get('interpretation','-')} |") ``` ```python for evt in events[:4]: stars = "⭐" * evt.get('importance', 3) sectors_str = "/".join(evt.get('related_sectors', ['综合'])) lines.append(f"### {stars} {evt['title']}") lines.append("") lines.append(f"**事件内容：** {evt['title']}") lines.append(f"**关联赛道：** {sectors_str}") ``` ```python for f in filings: lines.append(f"| {f.get('company','-')} | {f.get('event','-')[:20]} | {f.get('impact','-')[:20]} | {f.get('rating','-')} |") ``` ```python lines.append(f"| {idx.get('name','-')} | {idx.get('close',0):.2f} | {arrow} {idx.get('change_pct',0):+.2f}% | {trend} |") ``` ```python lines.append(f"- {s.get('name','-')} {s.get('change_pct',0):+.2f}%") ``` ### Technical Analysis The generator treats values loaded from externally supplied JSON files as trusted display text. Fields such as event titles, related sectors, interpretations, company names, filing descriptions, ratings, index names, and sector names are interpolated directly into Markdown without escaping Markdown metacharacters, table delimiters, line breaks, or raw HTML. An attacker who can influence an input JSON file or an upstream data-collection Skill can inject content such as: ```json { "events": [ { ...[truncated 2507 chars]- Remediation
View remediation