T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_gantt.py:589- Finding
Stored HTML and JavaScript Injection in Generated Gantt Reports
- Content
View full analysis
APQP项目甘特图 - {{ project_name }} ``` ```html {% for phase in phases %}{{ phase.name }}{% for task in phase.tasks %}{{ task.name }}{% if task.type == 'milestone' %} {% else %}``` Custom phase and task values are loaded from a user-selected JSON file without content validation: ```python # Lines 576-579 with open(args.phases, 'r', encoding='utf-8') as f: content = f.read() phases = json.loads(content) ``` The template is then rendered through `jinja2.Template`, which does not enable HTML autoescaping by default: ```python # Lines 589-590 template = Template(GANTT_HTML_TEMPLATE) html_content = template.render(**template_data) ``` ### Technical Analysis The `project_name` value originates from the `--project` command-line argument, while phas ...[truncated 2546 chars]- Remediation
View remediation
`, `"`, `'`, and `&`. Verify that the resulting document contains escaped entities and does not create executable elements or event-handler attributes. 6. **Consider a restrictive Content Security Policy** Add a defense-in-depth policy to the generated HTML, for example: ```html ``` The exact policy should be tested against intended report functionality. Autoescaping rema ...[truncated 67 chars]