T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/voc_analyzer.py:560- Finding
Stored HTML Injection Through Unsanitized CTQ Names in Generated Reports
- Content
View full analysis
CTQ优先级评分表
{''.join(f'''''' for s in scored_data['ctq_scores'])}
``` ### Technical Analysis The report generator constructs HTML with an f-string and directly inserts `s['ctq_name']` into a table cell without HTML escaping or sanitization. CTQ names can originate from a user-supplied CTQ JSON file. The value is copied into mapping data at `scripts/voc_analyzer.py:271`, propagated into scoring data at lines 316 and 355, and finally inserted into the generated HTML report at line 570. No validation restricts the field to plain text, and no output encoding is applied at the HTML sink. An attacker-controlled value such as: ```html排名 CTQ名称 频率评分 情感评分 权重评分 综合评分 优先级 {s['priority_rank']} {s['ctq_name']} {s['frequency_score']:.2f} {s['sentiment_score']:.2f} {s['importance_score']:.2f} {s['final_score']:.3f} {s['priority_level']} ``` is therefore interpreted as markup rather than displayed as text. Event-handler attributes can execute JavaScript when a user opens the generated report. ### Attack Path 1. An attacker creates or modifies a CTQ definition containing a malicious `name` value: ...[truncated 1640 chars]
- Remediation
View remediation
{int(score['priority_rank'])} {ctq_name} {float(score['frequency_score']):.2f} {float(score['sentiment_score']):.2f} {float(score['importance_score']):.2f} {float(score['final_score']):.3f} {priority_level} """) table_rows = ''.join(rows) ``` 3. Prefer an HTML template engine with automatic escaping enabled rather than manually assembling HTML with f-strings. 4. Validate CTQ input data before processing: - Require `name` to be a string. - Enforce a reasonable maximum length. - Reject control characters. - Restrict priority levels to the explicit allowlist `P0`, `P1`, `P2`, and `P3`. 5. Treat all labels passed to Pyecharts as untrusted data. Confirm that the library safely serializes chart labels, and sanitize or encode them before use if required. 6. Add regression tests using payloads containing HTML elements, quotes, event handlers, and closing tags. Verify that generated reports display these values as literal text and do not create executable DOM elements. 7. If reports are served over HTTP, deploy a restrictive Content Secur ...[truncated 179 chars]