T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/gen_report.py:82- Finding
HTML and JavaScript Injection in Generated Reports
- Content
View full analysis
str: months = list(range(1, 13)) mean = [round(stats["monthly"][str(m)]["mean"] * 100, 2) for m in months] win = [round(stats["monthly"][str(m)]["win_rate"] * 100, 1) for m in months] n = [stats["monthly"][str(m)]["n"] for m in months] bull = stats["bull"] bear = stats["bear"] years = sorted(int(y) for y in stats["yearly"].keys()) yret = [round(stats["yearly"][str(y)] * 100, 2) for y in years] last = tech["close"] peak = stats["peak"] peak_date = stats["peak_date"] from_peak = round((last / peak - 1) * 100, 1) trough = stats["trough"] trough_date = stats["trough_date"] cal = [1 if m in bull else (-1 if m in bear else 0) for m in months] bull_tag = " ".join(f'{m}月' for m in bull) or "—" bear_tag = " ".join(f'{m}月' for m in bear) or "—" html = f""" {name}({code}) 日历效应与买卖点策略 ``` Additional affected output contexts include direct interpolation into the report heading and body: ```python{name} ({code}) 日历效应与买卖点策略
``` The values originate from command-line arguments without validation or escaping: ```python html = build_html(stats, tech, args.name, args.code, args.label) ``` ### Technical Analysis The report generator directly interpolates `name`, `code`, and `price_label` into an HTML document. It does not apply HTML escaping or context-aware output encoding. Ot ...[truncated 1984 chars]- Remediation
View remediation