T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-cover-html.py:79- Finding
Stored HTML and JavaScript Injection Through Unescaped Cover Content
- Content
View full analysis
{word}' ) # Use the supplied emoji or the style's default emoji display_emoji = emoji if emoji else style_config["emoji"] # Build interaction-guide HTML when supplied guide_html = "" if guide_text: guide_html = f'''{guide_text}''' ``` The resulting values are inserted directly into the generated document: ```python 笔记封面 - {text[:20]}... ``` ```python {display_emoji}{highlighted_text}{guide_html} ``` ### Technical Analysis The command-line arguments `--text`, `--guide`, `--highlight`, and `--emoji` are treated as trusted HTML. They are interpolated into element content without HTML escaping or sanitization. Because browsers parse these values as markup rather than plain text, an attacker can inject arbitrary elements and event-handler attributes. For example, the following guide value creates an image whose error handler executes JavaScript when the generated file is opened: ```bash python scripts/generate-cover-html.py \ --text "Cover text" \ --guide '' \ --output malicious-cover.html ``` The generated document contains: ```html
``` The same injection principle applies to text, highlighting terms, and custom emoji. The title insertion is also unsafe because a value containing `` can leave the title context and inject elements i ...[truncated 2018 chars]- Remediation
View remediation
` wrapper. 3. Escape title content separately: ```python safe_title = escape(text[:20], quote=True) ``` 4. Do not use a general HTML sanitizer unless formatted HTML is intentionally supported. These arguments are documented as plain text, so encoding all markup characters is the safer design. 5. Add a restrictive Content Security Policy to generated pages as defense in depth: ```html ``` If external images or other resources become necessary, allow only specifically required sources. 6. Add automated tests for all input fields using payloads containing: - `