T09 · Insecure Skill Coding Practices
Error
- Location
references/build.py:301- Finding
Stored Script Injection in Generated Offline HTML Reports
- Content
View full analysis
0, "无新闻数据" tpl = TEMPLATE.read_text(encoding="utf-8") echarts = (ASSETS / "echarts.min.js").read_text(encoding="utf-8") world = (ASSETS / "world.json").read_text(encoding="utf-8") china = (ASSETS / "china.json").read_text(encoding="utf-8") xlsx_lib = (ASSETS / "xlsx.full.min.js").read_text(encoding="utf-8") news_js = json.dumps(news, ensure_ascii=False, indent=2) sugg_js = json.dumps(build_suggestions(news, role=role), ensure_ascii=False, indent=2) out = (tpl .replace("__ECHARTS_LIB__", echarts) .replace("__WORLD_JSON__", world.strip()) .replace("__CHINA_JSON__", china.strip()) .replace("__XLSX_LIB__", xlsx_lib) .replace("__NEWS__", news_js) .replace("__SAMPLE__", "true" if is_sample else "false") .replace("__SUGGESTIONS__", sugg_js)) ``` The resulting JSON is placed inside an executable JavaScript context: ```html- Remediation
View remediation
__NEWS_JSON__ ``` 2. Before embedding JSON in HTML, escape characters significant to the HTML parser: ```python def html_safe_json(value): return ( json.dumps(value, ensure_ascii=False) .replace("&", "\\u0026") .replace("<", "\\u003c") .replace(">", "\\u003e") .replace("\u2028", "\\u2028") .replace("\u2029", "\\u2029") ) ``` 3. Replace `innerHTML` rendering with DOM construction. Assign attacker-controlled text exclusively through `textContent`. 4. If limited rich text is an explicit requirement, sanitize it with a maintained strict-allowlist HTML sanitizer. Do not permit scripts, event-handler attributes, SVG, MathML, iframes, or unsafe URL schemes. 5. Validate links before assigning them: ```javascript function safeNewsUrl(value) { try { const url = new URL(value); return url.protocol === 'https:' || url.protocol === 'http:' ? url.href : null; } catch { return null; } } ``` Disable the link when validation fails, and add `rel="noopener noreferrer"` to links that open another browsing context. 6. Apply schema validation at every ingestion boundary. Enforce expected types, maximum lengths, valid coordinates, valid date formats, permitted categories, and HTTP(S)-only links. 7. Add regression tests using ``, event-handler markup, SVG payloads, malformed URLs, and `javascript:` URLs. Verify that each payload is displayed only as text and never creates executable DOM content. 8. Consider a restrictive Content Security Policy as defense in depth after inline script handling has been redesigned. CSP should supplement, not replace, contextual encoding and safe ...[truncated 14 chars]