T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_charts.py:349- Finding
Stored HTML and JavaScript Injection in Generated Reports
- Content
View full analysis
{idx + 1} {item['defect_type']} {item['total_count']} {item['percentage']}% """ ``` Other affected rendering sinks include: ```python{item[label_key]}``` ```python {item['defect_type']} ``` ### Technical Analysis The report generator constructs HTML by directly interpolating values from the analysis JSON. These values can originate from free-form fields in user-supplied Excel, CSV, Word, or PDF documents, including defect types, process names, product names, and shift labels. No HTML escaping or contextual output encoding is applied before these values are inserted into the report. Consequently, a value containing HTML elements or event-handler attributes is interpreted as active markup by the browser rather than displayed as text. For example, an attacker-controlled defect type could contain: ```html``` When the resulting report is opened, the browser creates the injected element and executes its event handler. The vulnerability is persistent because the payload is stored in the generated HTML report and may execute for every recipient who opens it. The vulnerable data appears in multiple report sections: - Defect classification ...[truncated 1610 chars]
- Remediation
View remediation
``` 6. Add automated regression tests using payloads containing `