T09 · Insecure Skill Coding Practices
Error
- Location
references/schema.py:526- Finding
Stored JavaScript Injection in Generated Wiki Reports
- Content
View full analysis
``).join(''); ``` ```javascript ndBody.innerHTML = html; ``` ```javascript dtEl.innerHTML = `` + DATA.data_rows.map(r => `` ).join('') + '${c.num}${c.label}
'; ``` ```python def generate_report(wiki_dir: Path) -> Path: """生成 wiki 可视化报告 HTML。返回输出文件路径。""" data = collect_report_data(wiki_dir) html = REPORT_HTML_TEMPLATE html = html.replace("{{WIKI_NAME}}", data["name"]) html = html.replace("{{WIKI_DESC}}", data.get("description", "")) html = html.replace("{{ONTOLOGY_TYPE}}", data.get("ontology_type", "")) html = html.replace("{{TOTAL_PAGES}}", str(data["total_pages"])) html = html.replace("{{JSON_DATA}}", json.dumps(data, ensure_ascii=False, default=str)) out_path = wiki_dir / "_report.html" out_path.write_text(html, encoding="utf-8") return out_path ``` ### Technical Analysis The report generator incorporates wiki-controlled metadata and page-derived values directly into an HTML document. Some values are inserted through string replacement, while the complete data model is embedded in an inline script using `json.dumps()`. JSON serialization alone is not sufficient for safe embedding inside an HTML `` can terminate the original script element and inject new HTML or JavaScript. The generated c ...[truncated 1883 chars]Page Field Value Unit Period Conf. ${r.page} ${r.field} ${r.value} ${r.unit} ${r.period} ${r.confidence} - Remediation
View remediation
` as `\u003e` - `&` as `\u0026` - U+2028 and U+2029 as Unicode escapes 6. Prefer placing serialized data in an inert `${maliciousValue} ``` ]]>