T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_webapp.py:27- Finding
Stored Cross-Site Scripting and JavaScript Injection in Generated Applications
- Content
View full analysis
str: """Generate the HTML file.""" title = self.content.get('metadata', {}).get( 'title', '教材虚拟仿真系统' ) html_content = f''' {title} - 虚拟仿真系统 ``` The same value is inserted into visible HTML without HTML escaping: ```python``` It is also placed into a generated JavaScript file and JavaScript string contexts: ```python def generate_javascript(self) -> str: """Generate JavaScript code.""" title = self.content.get('metadata', {}).get( 'title', '教材虚拟仿真系统' ) js_content = f'''// 教材虚拟仿真系统 - 主应用文件 // 生成时间: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')} // 系统名称: {title} import SimulationScene from './scene.js'; import QuizComponent from './quiz.js'; import ProgressTracker from './progress.js'; import DataAnalyzer from './analytics.js'; class App {{ constructor() {{ this.scene = null; this.quiz = null; this.progress = null; this.a ...[truncated 5029 chars]{title}
- Remediation
View remediation
`, headings, and paragraphs. - HTML attribute encoding for attribute values. - JavaScript-safe serialization for JavaScript values. - Do not interpolate untrusted input into comments, template literals, or executable source code. 4. Store application data in a non-executable JSON element or separate JSON file. Parse it at runtime rather than embedding arbitrary input directly into JavaScript source. 5. Validate input against a strict schema: - Require expected primitive types. - Limit field lengths and array sizes. - Restrict enumerated values such as question type and recommendation priority. - Reject unexpected nested objects where strings are expected. 6. Add a restrictive Content Security Policy. At minimum, avoid `unsafe-inline`, restrict scripts to reviewed origins, and restrict outbound connections with `connect-src`. 7. Add automated tests using payloads that cover HTML text, attributes, script termination, template literals, event handlers, SVG, and malformed markup. ]]>