T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_report.py:39- Finding
Stored Cross-Site Scripting in Generated HTML Audit Reports
- Content
View full analysis
str: """Render the template using Jinja2.""" try: from jinja2 import Template t = Template(template) return t.render(**data, datetime=datetime) except ImportError: # Fall back to inline generation return _generate_inline_html(data) ``` The fallback renderer also interpolates untrusted values directly into HTML: ```python issues_rows = "" for i, issue in enumerate(top_issues, 1): issues_rows += f""" {i} {issue.get('item_id', '')} {issue.get('name', '')} {issue.get('category', '')} {issue.get('evidence', '')} {issue.get('note', '')} """ ``` The primary HTML template displays the affected values in the document: ```html {% for issue in top_issues %} {{ loop.index }} {{ issue.item_id }}- Remediation
View remediation
str: return escape(str(value if value is not None else ""), quote=True) ``` Use `escape_html()` for `item_id`, `name`, `category`, `evidence`, `note`, audit metadata, category names, and recommendation content before interpolation. 4. Avoid inserting untrusted values into HTML attributes or CSS class names. Validate category values against a strict allowlist and use a fixed safe fallback. 5. Validate the JSON schema before analysis. Require expected scalar types, reject nested objects in text fields, and impose reasonable maximum lengths. 6. Add automated regression tests using payloads in every displayed field, including: ```html"> ``` Tests should verify that generated reports contain escaped text such as `<script>` and no executable elements or event-handler attributes. 7. Apply a restrictive Content Security Policy when reports are served over HTTP, for example: ```http Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:; script-src 'none'; base-uri 'none'; form-action 'none' ``` A C ...[truncated 120 chars]