T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_html.py:54- Finding
Unescaped User-Controlled Content Allows Active HTML and JavaScript Injection
- Content
View full analysis
', "目 录
", '- ']
for h in headings:
indent = " " * (h["level"] - 1)
toc_lines.append(
f'{indent}
- {h["text"]} ' ) toc_lines.append("
{{product_name}}{{toc}}{{content}}``` ### Technical Analysis The generator places several sources of user-controlled data directly into an HTML document: 1. Command-line metadata such as the title, product name, company, document number, version, and date is sub ...[truncated 3273 chars]- Remediation
View remediation
' f'{safe_text}' ) ``` 3. **Sanitize converted Markdown with a strict allowlist.** Process the generated body with a maintained sanitizer such as Bleach. Permit only the elements and attributes required by the quality-plan format, and prohibit scripts, event handlers, embedded frames, forms, and unsafe URL schemes. ```python import bleach allowed_tags = [ "h1", "h2", "h3", "p", "ul", "ol", "li", "table", "thead", "tbody", "tr", "th", "td", "pre", "code", "blockquote", "hr", "strong", "em", "a" ] allowed_attributes = { "h1": ["id"], "h2": ["id"], "h3": ["id"], "a": ["href", "title"], } body_html = bleach.clean( body_html, tags=allowed_tags, attributes=allowed_attributes, protocols=["http", "https", "mailto"], strip=True, ) ``` 4. **Disable raw HTML at the Markdown ingestion stage if it is not required.** Treat embedded HTML as plain text rather than trusted markup. Sanitization should still be retained as defense in depth. 5. **Use an auto-escaping template engine.** Replace manual `str.replace()` templating with a template engine such as Jinja2 configured with automatic HTML escaping. Explicitly mark onl ...[truncated 939 chars]