T09 · Insecure Skill Coding Practices
Warning
- Location
references/generate_report.py:122- Finding
HTML and JavaScript Injection Through Unescaped Report Metadata
- Content
View full analysis
' + date + '\n' ... ' 段位 · ' + tier + '\n' ``` By contrast, other textual fields such as `title`, `subtitle`, `verdict`, `persona`, and tags are passed through the `esc()` function before being rendered. ### Technical Analysis The report generator reads a caller-supplied JSON specification and constructs an HTML document through string concatenation. Because `tier` and `date` are not passed through `esc()`, an attacker who can control either field can terminate the intended text context and insert arbitrary HTML. For example, a malicious specification could contain: ```json { "score": 80, "tier": "", "date": "2026-09-16" } ``` The resulting report would include the attacker-controlled element directly inside the document. When the HTML report is opened in a browser, the `onerror` handler can execute JavaScript. This vulnerability is caused by inconsistent output encoding. Although the existing `esc()` function encodes `&`, `<`, and `>`, it is not applied to all untrusted textual fields. ### Attack Path 1. An attacker gains the ability to supply or influence a JSON report specification. 2. The attacker places an HTML or event-handler payload in the `tier` or `date` field. 3. A user or automated workflow invokes the documented generator: ```bash python references/gen ...[truncated 1188 chars]
- Remediation
View remediation
``` 5. **Add regression tests** that place payloads in every input field and verify the resulting document contains encoded text rather than executable markup. Test at minimum `