T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check_ssl.py:187- Finding
Stored HTML Injection in Generated Certificate Reports
- Content
View full analysis
{error}' if error else "" rows += f""" {r['hostname']}:{r['port']} {subject} {status_icon} {r['status'].replace('_', ' ').title()} {days} {expiry} {issuer} {', '.join(r['san'][:5])} {error_row}""" ``` ### Technical Analysis The HTML report generator inserts dynamic values directly into HTML without context-appropriate escaping. The affected values include: - User-supplied hostnames - Certificate subject common names - Certificate issuer names - Subject Alternative Name entries - Network and certificate error messages - Status and other report fields Because these values are interpolated as markup rather than encoded as text, an attacker-controlled value containing HTML elements or event-handler attributes can alter the generated document. For example, a crafted hostname containing an HTML payload remains present in the result object even if DNS resolution fails and is subsequently inserted into the report. The generated report does not apply HTML escaping or a restrictive Content Security Policy. Consequently, active HTML content such as an element with an inline event handler may execute when the user opens the report in a browser. ### Attack Path 1. An attacker convinces the user or an automated process to include a c ...[truncated 1458 chars]- Remediation
View remediation
``` The policy should be tested against the report's actual resource requirements. HTML escaping remains mandatory even when a CSP is present. 6. Add regression tests covering hostile values in every rendered field, including payloads such as: ```text"> ``` Tests should verify that these values appear as encoded text and are never interpreted as HTML elements. ]]>