T09 · Insecure Skill Coding Practices
Error
- Location
scripts/Gxpcode_html.py:326- Finding
Stored HTML and JavaScript Injection in Bilingual HTML Exports
- Content
View full analysis
{entry["text"]}\n' # Build segments segs_html = "" current_section = None section_counter = {} for i, el in enumerate(elements): zh = zh_lookup.get(i, "") en = el["text"] en = preprocess_latex(en) zh = preprocess_latex(zh) if paddleocr_dir and out_dir: en = fix_image_paths(en, paddleocr_dir, out_dir) zh = fix_image_paths(zh, paddleocr_dir, out_dir) en = re.sub(r'(§{sec_num} {en} · §{sec_num} {zh}\n' else: segs_html += f"""""" ``` The same file also inserts the caller-controlled document title directly into active HTML: ```python {title} ``` ### Technical Analysis OCR-derived source text, translated text, headings, and the document title are inserted directly into an active HTML document. These values are not escaped or ...[truncated 2367 chars]{en}{zh}复制- Remediation
View remediation
``` 6. Move required JavaScript into a fixed bundled script or use non-script controls so that `unsafe-inline` is not needed. 7. Add regression tests using payloads in headings, paragraphs, tables, images, translated text, and titles. ]]>