T09 · Insecure Skill Coding Practices
Error
- Location
scripts/structure_contacts.py:217- Finding
Stored HTML and JavaScript Injection in the Generated CRM Dashboard
- Content
View full analysis
const contacts = {json.dumps(data, ensure_ascii=False)}; function renderTable(list) {{ const tbody = document.getElementById('contactTableBody'); tbody.innerHTML = list.map(c => ` ${{c.name || '-'}} ${{c.role_title ? '' + c.role_title + '' : ''}} ${{c.org_school ? '' + c.org_school + '' : ''}} ${{!c.role_title && !c.org_school ? '-' : ''}} ${{c.industry || '-'}} ${{c.venue_event ? '📍 ' + c.venue_event : '-'}} ${{c.city || '-'}} ${{c.time_met || '-'}} ${{c.raw}} `).join(''); }} ``` ### Technical Analysis The input records originate from an arbitrary text file and can also be derived from OCR of contact remarks. These values are therefore untrusted. Fields including `raw`, `name`, `role_title`, `org_school`, `industry`, `venue_event`, `city ...[truncated 2328 chars]- Remediation
View remediation
SAFE_SERIALIZED_JSON ``` The serializer should escape at least `<`, `>`, `&`, U+2028, and U+2029. The client should parse the element's text content with `JSON.parse()`. 5. Add a restrictive Content Security Policy that disallows inline scripts and unauthorized outbound connections. CSP should be defense in depth rather than the primary injection fix. 6. Add regression tests covering values containing: ```text"'> ``` The tests should verify that these values appear only as literal text and never create executable DOM elements. ]]>