T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_dashboard.py:91- Finding
HTML and JavaScript Injection in Generated Financial Dashboards
- Content
View full analysis
{stock_name}（{stock_code}）动态财务分析看板 {ECHARTS_CDN} {CSS_FRAMEWORK}""" ``` ### Technical Analysis The function inserts `stock_name` and `stock_code` directly into HTML text contexts without HTML escaping. A value containing markup can therefore terminate the existing element and inject arbitrary HTML or JavaScript. The serialized `core_data` and `metrics` objects are also inserted directly into a `` can terminate the script element because HTML parsing occurs before JavaScript parsing. For example, an input containing the following value could escape from the intended context: ```html ``` This is a stored client-side injection issue because the payload is written into the generated dashboard and execut ...[truncated 1363 chars]{stock_name}（{stock_code}）动态财务分析数据可视化看板
资产负债趋势
营收与净利润趋势
- Remediation
View remediation
` block. At minimum, neutralize characters significant to the HTML parser: ```python def safe_json_for_html(value): return ( json.dumps(value, ensure_ascii=False) .replace("&", "\\u0026") .replace("<", "\\u003c") .replace(">", "\\u003e") .replace("\u2028", "\\u2028") .replace("\u2029", "\\u2029") ) ``` 3. Prefer placing serialized data in a non-executable element: ```html ``` Then read and parse its `textContent`. The JSON must still encode `<` to prevent `` termination. 4. Validate stock codes against their expected format, such as exactly six decimal digits, and constrain company names to a reasonable length. 5. Add regression tests using payloads such as: ```text``` 6. Deploy generated dashboards with a restrictive Content Security Policy that disallows inline and unauthorized remote scripts. ]]>