T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gen_html.py:73- Finding
Unescaped Presentation Data Allows Stored HTML and JavaScript Injection
- Content
View full analysis
🦞{title}
{subtitle}
''' return content def make_content_slide(title, items): if isinstance(items, list): items_html = ''.join(f'- {item}
' for item in items) return f'\n{title}
\n- {items_html}
{title}
\n{items}
\n' def make_cards_slide(title, cards): cards_html = '' for card in cards: cards_html += f'\n' return f'\n{card["icon"]} {card["title"]}
{card["content"]}
{title}
\n{cards_html}\n' def make_chart_slide(title, data): bars = '' for item in data: h = item.get("height", 100) bars += f'''\n''' return f'\n{item["value"]}{item["label"]}{title}
\n{bars}\n' def make_swot_slide(title, strengths, weaknesses): s_items = ''.join(f'- {s}
' for s in strengths) w_items = ''.join(f'- {w}
' for w in weaknesses) return f'''{title}
\n''' ``` The resulting fragments are subsequently inserted into the final document without escaping: ```python total = len(data.get("slides", [])) + 1 html = HTML_TEMPLATE.format(title=args.title, slides=slides_html, to ...[truncated 2661 chars]💪 Strengths 优势
- {s_items}
⚠️ Weaknesses 劣势
- {w_items}
- Remediation
View remediation
` elements, event handlers, quoted attribute breakers, CSS-breaking values, and encoded variants. 7. Consider deploying generated presentations with a restrictive Content Security Policy that disallows inline and remote scripts. This should be defense in depth and must not replace output encoding. ]]>