T09 · Insecure Skill Coding Practices
Error
- Location
index.js:566- Finding
Arbitrary JavaScript Execution in Generated HTML Reports
- Content
View full analysis
`- ${path.basename(file)} - 第${index + 1}张设计稿
` ).join('\n')} ``` ```javascript ${title} ``` ```javascript const pages = ${JSON.stringify(sections, null, 2)}; ``` ```javascript pages.forEach((page, index) => { const pageEl = document.createElement('div'); pageEl.className = 'page'; pageEl.id = `page-${index}`; // 使用绝对路径加载图片 const imagePath = page.image ? `${window.location.pathname.replace(/[^/]*$/, '')}${page.image}` : ''; const imageHtml = imagePath ? `` : `
图片位置: ${page.title}`; pageEl.innerHTML = ``; container.appendChild(pageEl); }); ``` ### Technical Analysis The report generator embeds multiple untrusted values into HTML, HTML attributes, CSS, and an executable inline JavaScript block without context-appropriate encoding or sanitization. These values include: - The report `title` - Cu ...[truncated 3811 chars]${page.title}
${page.tags ? page.tags.map(tag => `${tag}`).join('') : ''} ${page.content}${imageHtml}- Remediation
View remediation
/g, '\\u003E') .replace(/&/g, '\\u0026') .replace(/\u2028/g, '\\u2028') .replace(/\u2029/g, '\\u2029'); } ``` A safer design is to place encoded JSON in a non-executable `