T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/make_report.py:30- Finding
Stored HTML Attribute Injection in Generated Reports
- Content
View full analysis
", ">")) def color_for(i): return PALETTE[i % len(PALETTE)] def domain_bars(by_domain): items = by_domain.most_common() maxn = items[0][1] if items else 1 out = [] for i, (dom, n) in enumerate(items): w = pct(n, maxn) c = color_for(i) out.append( f'' f'' ) ``` ### Technical Analysis The custom `esc()` function encodes ampersands and angle brackets but does not encode quotation marks. The escaped domain value is subsequently inserted into a double-quoted `title` attribute. A malicious domain value containing a double quote can terminate the intended attribute and introduce another attribute, including an event handler. For example: ```text x" onmouseover="alert(document.domain) ``` This produces markup equivalent to: ```html{esc(dom)}' f'' f'{n}' f'``` The domain value can originate from a supplied CSV file or from a custom domain registry, both of which are accepted inputs in the documented workflow. Escaping angle brackets alone therefore does not prevent execution because the payload is injected into an existing HTML tag. Other report fields generally pass through the same incomplete escaping function. Most are inserted into text contexts, but future use in attribute contexts could introduce additional injection points. ### Attack Path 1. An attacker supplies or modifies a st ...[truncated 1041 chars]- Remediation
View remediation
``` 5. Add regression tests using domain values containing `"`, `'`, `<`, `>`, and event-handler payloads. Verify that generated markup contains encoded forms such as `"` and does not create additional attributes. ]]>