T09 · Insecure Skill Coding Practices
Error
- Location
scripts/report_builder.py:14- Finding
Stored HTML and JavaScript Injection in Generated Reports
- Content
View full analysis
Top {i+1} {loc['name']}{loc['transit']} 个如：{loc['transit_short']}{loc['office']} 个{loc['competitors']} 家{loc['score']} 分 """ micro_insights_html = "" detailed_pois_html = "" for i, loc in enumerate(locations_data): micro_insights_html += f"""""" office_tags = "".join( [f"{name}" for name in loc['office_list']] ) or "暂无核心设施" comp_tags = "".join( [f"{name}" for name in loc['comp_list']] ) or "暂无直接竞品" ``` The macro insight is also inserted directly into the document: ```python📍 Top {i+1} : {loc['name']}
{loc['micro_insight']}
{macro_insight}``` Location data is additionally serialized inside an executable script element: ```python- Remediation
View remediation
` element after safely escaping `<`, `>`, `&`, U+2028, and U+2029. - Load data from a separate local JSON resource. - Use a framework-provided safe JSON serialization mechanism. 4. Escape at least the following characters in script-embedded JSON: ```python safe_json = json.dumps(data, ensure_ascii=False) safe_json = ( safe_json .replace("&", "\\u0026") .replace("<", "\\u003c") .replace(">", "\\u003e") .replace("\u2028", "\\u2028") .replace("\u2029", "\\u2029") ) ``` 5. Add a restrictive Content Security Policy. Avoid allowing inline scripts where feasible, and restrict network destinations to the minimum required domains. 6. Add regression tests using payloads containing HTML event handlers, quotation marks, ``, and Unicode line separators. ]]>