T09 · Insecure Skill Coding Practices
Error
- Location
scripts/build_html.py:128- Finding
Persistent Script Injection in Generated HTML Reports
- Content
View full analysis
\n' html += f'{step["tag"]}\n' html += f'{step["h2"]}
\n' for p in step.get('paragraphs', []): html += f'{p}
\n' fig = step.get('figure') if fig and fig.get('src'): html += ' \n' html += f'\n' html += f' {fig.get("caption", "")}\n' html += ' \n' html += ' \n' return html ``` In `scripts/build_html.py:239-265`, additional fields are inserted into HTML and CSS contexts without escaping or strict validation: ```python repl = { # CSS / brand '__TITLE__': data.get('title', '产业周期 Scrollytelling 复盘'), '__BRAND_GREEN__': green, '__BRAND_GREEN_D__': green_d, # Hero '__HERO_KICKER__': data.get('hero', {}).get('kicker', ''), '__HERO_H1_PREFIX__': data.get('hero', {}).get('h1Prefix', ''), '__HERO_H1_EM__': data.get('hero', {}).get('h1Em', ''), '__HERO_THESIS__': data.get('hero', {}).get('thesis', ''), '__META_ROW_HTML__': generate_meta_row_html(data.get('hero', {}).get('metaRow', [])), '__VIZ_NOTE__': data.get('vizNote', f'数据截至 {data.get("asOf", "") ...[truncated 8743 chars]
- Remediation
View remediation
``` - Serialize the data and explicitly escape at least `<`, `>`, `&`, U+2028, and U+2029 before embedding it. - Parse the value with `JSON.parse(document.getElementById('report-data').textContent)`. - Alternatively, load the data into the page through a safe build-time mechanism that cannot terminate a script element. 3. **Remove unsafe DOM construction** - Replace `innerHTML` string concatenation with `document.createElement()`, `textContent`, `classList`, and safe property assignment. - Construct SVG nodes with `document.createElementNS()` rather than assigning generated SVG strings to `innerHTML`. - Use `textContent` for clock details, signal values, score fields, event descriptions, labels, and other plain-text data. 4. **Sanitize explicitly allowed rich text** - If fields must support limited formatting such as ``, pass them through a mature allowlist-based HTML sanitizer. - Permit only the minimum required elements and attributes. - Remove scripts, inline event handlers, embedded objects, forms, unsafe SVG, `style` attributes, and dangerous URL protocols. 5. **Validate typed fields strictly** - Restrict IDs, viewport names, state names, class names, and status values to defined enums or conservative character allowlists. - Validate colors using a strict pattern such as six-digit hexadecimal notation rather than interpola ...[truncated 1185 chars]