T09 · Insecure Skill Coding Practices
Error
- Location
assets/report-template.html:570- Finding
Stored HTML and Script Injection in Generated Reports
- Content
View full analysis
0 else 0 }) ``` ```python conclusions = [] conclusions.append(f"本次分析共涵盖{len(supplier_summary)}家供应商，{total_batches}批次来料数据") conclusions.append(f"整体批次合格率为{batch_pass_rate:.2f}%，来料不良PPM为{ppm:.2f}") if ppm > 2000: conclusions.append(f"不良率偏高，PPM达到{ppm:.2f}，建议重点关注不良TOP1项：{defect_type_top[0]['defect_type'] if defect_type_top else '无'}") else: conclusions.append(f"整体质量良好，PPM控制在{ppm:.2f}，符合质量要求") if defect_type_top: top_defect = defect_type_top[0] conclusions.append(f"主要不良类型为'{top_defect['defect_type']}'，占比{top_defect['percentage']:.2f}%，建议供应商针对性改善") if len(supplier_summary) > 1: worst_supplier = supplier_comparison[-1]['supplier'] conclusions.append(f"多供应商对标中，'{worst_supplier}'综合表现最差，建议重点跟进并约谈改善") ``` The report generator uses a Jinja template without enabling HTML autoescaping: ```python def generate_html(self): """生成HTML格式报告""" template_path = Path(__file__).parent.parent / "assets" / "report-template.html" try: with open(template_path, 'r', encoding='utf-8') as f: template_content = f.read() except FileNotFoundError: # 如果模板不存在，使用内置模板 template_content = self._get_builtin_template() template = Template(template_content) html_content = template.render(**self.data) return html_content ``` The primary and fallback t ...[truncated 2570 chars]- Remediation
View remediation
{{ conclusion }} ``` 3. Do not embed presentation markup inside conclusion strings. Represent emphasis as structured data: ```python { "severity": "warning", "message": f"Defect PPM is {ppm:.2f}." } ``` The template can then select a trusted CSS class based on a fixed allowlist while escaping the message. 4. If limited user-supplied HTML is an explicit requirement, sanitize it with a mature allowlist sanitizer before rendering. Permit only necessary formatting tags and attributes; reject scripts, event handlers, URLs, inline styles, SVG, and embedded objects. 5. Add regression tests using payloads in supplier, defect-type, and inspection-item fields, including: ```html"> ``` The generated HTML must contain escaped text rather than executable elements. ]]>