T09 · Insecure Skill Coding Practices
Error
- Location
scripts/render_report.py:56- Finding
Stored HTML and JavaScript Injection in Generated Reports
- Content
View full analysis
{p}" for p in hs.get("points", [])) or "- Data unavailable
" ``` At lines 141-143, content read from `ai_analysis.md` is inserted without HTML escaping: ```python cards.append(f"""""") ``` At lines 159-161, analyst forecast fields are inserted into table cells without escaping: ```python rows = "\n".join( f"{f.get('broker','')}{f.get('rating','')}" f"{f.get('target_price','N/A')}{f.get('date','')}" for f in forecasts ) ``` At lines 172-173 and 235-236, report metadata is embedded directly in the document title and body: ```python {d['ticker']} {d['name']} Analysis Report ``` ```python{title}{body_text}{d['ticker']} {d['name']}``` ### Technical Analysis The renderer treats values from `data.json`, AKShare responses, and `ai_analysis.md` as trusted HTML. These values are interpolated into HTML elements without context-sensitive output encoding. The limited Markdown processing at lines 138-139 only strips Markdown links and bold syntax. It does not remove HTML elements, event-handler attributes, scriptable URLs, or other executable markup. Consequently, a value such as the following would be preserved in the generated document: ```html``` When the generated `index.html ...[truncated 1921 chars]
- Remediation
View remediation
alert(1)