T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scanner.py:307- Finding
Stored HTML and Script Injection in Generated Reports
- Content
View full analysis
{f['file']}" f"---" f"Error: {f['error']}\n" ) else: ctx = " | ".join(f.get("context", [])) detail_rows += ( f"{f['file']}{f['line']}" f"{f['description']}{f['severity']}" f"{f['match']}{ctx[:60]}\n" ) ``` ### Technical Analysis The HTML report generator directly interpolates dynamic data into HTML markup without applying HTML escaping. The affected values include: - Scanned file paths and filenames - File-reading error messages - Finding descriptions and masked matches - Context extracted from scanned file contents These values may contain attacker-controlled characters such as `<`, `>`, `"`, `'`, and `&`. Consequently, an attacker can inject arbitrary HTML elements or JavaScript event handlers into the generated report. A malicious filename is sufficient to reach the vulnerable output path without enabling context collection. Malicious content inside a scanned file can also reach the HTML report when the user enables the `--context` option. ### Attack Path 1. An attacker provides a file whose filename contains an HTML payload, or whose contents contain a payload such as an element with a JavaScript event handler. 2. The victim scans the attacker-controlled file or directory and selects HTML output: ```bash python3 scripts/scanner.py --dir ./untrusted-data --format html --output report.html ``` 3. For content-based injection, the victim additionally enables `--co ...[truncated 1019 chars]- Remediation
View remediation
alert(1)"> ``` 6. Consider adding a restrictive Content Security Policy to generated reports as defense in depth. Escaping remains mandatory because a policy alone is not a substitute for safe output encoding. ]]>