T09 · Insecure Skill Coding Practices
Warning
- Location
- assets/report-template.html:96
- Finding
- Unescaped Template Placeholders Permit HTML and Script Injection in Generated Reports<![CDATA[ ## Vulnerability Details **File Location**: `assets/report-template.html`, lines 96–117 **Vulnerability Type**: Unescaped HTML template injection **Risk Level**: Medium ### Vulnerable Code ```html <section class="tab active" id="module-1"> <h2>{{MODULE_NAME}}</h2> <p><strong>Module conclusion:</strong>{{MODULE_CONCLUSION}}</p> <h3>Covered submenus</h3> <p>{{COVERED_MENUS}}</p> <h3>Formal issues</h3> <div class="issue formal"> <span class="badge danger">Formal ISSUE</span> <strong>{{ISSUE_ID}}｜{{ISSUE_TITLE}}</strong> <p><strong>URL:</strong>{{PAGE_URL}}</p> <p><strong>Reproduction steps:</strong>{{REPRO_STEPS}}</p> <p><strong>Expected result:</strong>{{EXPECTED}}</p> <p><strong>Actual result:</strong>{{ACTUAL}}</p> <p><strong>Evidence:</strong>{{EVIDENCE_REF}}</p> </div> {{FORMAL_ISSUE_BLOCKS}} ``` Additional raw block placeholders, including `{{MODULE_TAB_BUTTONS}}`, `{{EVIDENCE_FIGURES}}`, and `{{MODULE_SECTIONS}}`, occur elsewhere in the same template and increase the exposed rendering surface. ### Technical Analysis The HTML report template places scalar values and generated content blocks directly into executable HTML contexts. The project does not define contextual output encoding, a strict HTML sanitizer, or a trusted rendering boundary for these placeholders. UAT data can originate from an application being tested, including page titles, displayed messages, URLs, issue descriptions, actual results, and evidence captions. Such values must be treated as untrusted. If report generation replaces a placeholder verbatim, attacker-controlled markup can become active HTML. For example, a tested application could display content containing an element with an event handler. If that content is copied into `{{ACTUAL}}`, `{{ISSUE_TITLE}}`, or another placeholder without encoding, the browser may execute it when a reviewer opens the generated report. Whole-block placeholders are especially sensitive becaus ...[truncated 1461 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Apply contextual HTML escaping to every scalar placeholder, including project names, conclusions, module names, issue titles, URLs, reproduction steps, expected results, actual results, and evidence references. 2. Treat all content copied from the tested application as untrusted, even when it appears to be ordinary text. 3. Generate repeated tables, issue blocks, tabs, and evidence figures through a templating engine with automatic escaping enabled by default. 4. Where rich HTML is required, sanitize it with a strict allowlist that permits only necessary formatting elements and safe attributes. 5. Explicitly reject: - `script`, `iframe`, `object`, `embed`, and active SVG content; - inline event-handler attributes such as `onclick` and `onerror`; - `javascript:` and other dangerous URL schemes; - inline styles or elements capable of deceptive document overlays, unless strictly required. 6. Validate URL placeholders and allow only expected schemes such as `https`, or render URLs as escaped plain text. 7. Add a restrictive Content Security Policy, preferably disallowing inline scripts. Move the existing tab-handling script to a trusted local script file if necessary. 8. Add automated tests using payloads in every placeholder to verify that generated reports render them as inert text. 9. Document the trust boundary and require sanitization before any value is inserted into whole-block placeholders. ]]>