T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_html.py:145- Finding
Stored HTML and JavaScript Injection in Generated Reports
- Content
View full analysis
= 100 else "status-warning" if float(rate.rstrip("%")) >= 90 else "status-error" status_text = "达标" if float(rate.rstrip("%")) >= 100 else "接近" if float(rate.rstrip("%")) >= 90 else "未达" metrics_rows += f'{name}{actual}{target}{rate}{status_text}\n' # Generate production-line rows production = data.get("production", []) production_rows = "" for p in production: production_rows += f'{p.get("line", "")}{p.get("output", "")}{p.get("quality", "")}{p.get("oee", "")}{p.get("note", "-")}\n' production_analysis = f'数据分析：{data.get("production_analysis", "暂无")}
' if data.get("production_analysis") else "" # Generate completed items completed_items = "" for item in data.get("completed", []): completed_items += f'
{item.get("result", "")}进行中项目
- '
for item in data.get("in_progress"):
in_progress += f'
- {item.get("title", "")}
{item.get("progress", "")} \n'
in
...[truncated 3970 chars]
- Remediation
View remediation
``` 5. Add regression tests covering malicious values in every rendered field. Payloads such as the following must appear only as escaped text: ```html``` 6. Regenerate or sanitize previously created reports before redistributing them, because existing files may already contain persistent injected markup. ]]>