T09 · Insecure Skill Coding Practices
Error
- Location
scripts/weather_strip.py:515- Finding
Stored HTML, SVG, and JavaScript Injection Through Unescaped Schedule Names
- Content
View full analysis
0: elements.append( f'' ) elements.append( f'{hourly_cities[i]}' ) ``` ```python # scripts/weather_strip.py:593-601 scrubber_data.append({ "time": t.strftime("%-I:%M %p"), "day": t.strftime("%a %-m/%-d"), "temp": f"{temps[i]:.0f}{unit_sym}", "feels": f"{feels[i]:.0f}°", "dew": f"{dews[i]:.0f}°", "cloud": f"{clouds[i]}%", "rain": f"{rain_probs[i]}%", "wind": f"{winds[i]:.0f} {wind_unit}", "uv": f"{uv_vals[i]:.0f}", "humidity": f"{humids[i]}%", "city": hourly_cities[i] if i < len(hourly_cities) else "", }) ``` ```python # scripts/weather_strip.py:638-642 city = daily_cities[i] if i < len(daily_cities) else "" dsvg.append(f'{d.strftime("%a")}') if city and (i == 0 or daily_cities[i] != daily_cities[i-1]): dsvg.append(f'{city}') ``` ```python # scripts/weather_strip.py:858-887 const da ...[truncated 4701 chars]- Remediation
View remediation
`. Prefer a non-executable JSON container: ```html ``` Escape at least `<`, `>`, `&`, U+2028, and U+2029 before embedding, then parse the element's `textContent` with `JSON.parse()`. 3. Replace `innerHTML` with DOM construction and `textContent`. For example: ```javascript const cityNode = document.createElement("div"); cityNode.className = "ws-tt-city"; cityNode.textContent = d.city; tooltip.replaceChildren(cityNode); ``` Construct the remaining tooltip rows through `createElement()` and assign all data values through `textContent`. 4. Validate schedule names before processing. Apply a reasonable maximum length and, where compatible with product requirements, a conservative allowlist of letters, numbers, spaces, apostrophes, hyphens, and periods. 5. Apply a restrictive Content Security Policy to pages embedding the widget. Avoid `unsafe-inline` scripts and use nonces or external scripts. This is defense in depth and does not replace proper output encoding. 6. Add regression tests using city names containing: - `<`, `>`, `&`, single quotes, and double quotes. - Closing SVG or HTML tags. - `` sequences. - Event-handler attributes and SVG active-content payloads. Tests should verify that generated output displays these values strictly as text and never creates additional DOM elements or executable script. ]]>