T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate.py:245- Finding
Stored Cross-Site Scripting in Generated Map HTML
- Content
View full analysis
{w["num"]}{w["name"]}' ) ``` ```html``` ```javascript waypoints.forEach(function(wp){ var last = waypoints[waypoints.length-1].num; var color = wp.num==='1'?'{accent}':(wp.num===last?'#10b981':'#ff9f43'); L.circleMarker([wp.lat,wp.lon], {radius:10, color:'white', weight:3, fillColor:color, fillOpacity:1}) .addTo(map).bindPopup('🚶 CITYWALK{title}
{subtitle}
'+wp.num+''+wp.name+''+(wp.desc||'')+''); var lbl = L.divIcon({html:''+wp.name+'', className:'', iconSize:[0,0], iconAnchor:[0,0]}); L.marker([wp.lat,wp.lon], {icon:lbl}).addTo(map); }); ``` ```python html = HTML.format( lang='zh-CN' if args.lang == 'zh' else 'en', title=title, subtitle=subtitle, accent=ACCENT, accent_dark=darken(ACCENT), waypoints_json=json.dumps(waypoints), route_json=json.dumps(route_coords), center_lat=clat, center_lon=clon, dist=fmt_d(td), dur=total_dur_str, n=len(waypoints), walk=walk_str, route_html=route_html, tips_html=tips_html, stats_col=stats_col, stats_extra=stats_extra, tile_url=args.tile_url or 'https://tile.openstreetmap.org/{z}/{x ...[truncated 2743 chars]- Remediation
View remediation
... ``` Parse it using: ```javascript const waypoints = JSON.parse( document.getElementById('waypoints-data').textContent ); ``` When creating the JSON text, escape at least `<`, `>`, `&`, U+2028, and U+2029. 4. Add a restrictive Content Security Policy. Where practical, disallow inline scripts and event handlers: ```html ``` 5. Validate and normalize all route fields, but do not rely on input validation as a substitute for contextual encoding. 6. Add regression tests covering HTML tags, quotation marks, event handlers, ``, Unicode line separators, and malformed markup in titles, names, and descriptions. ]]>