T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_board.py:153- Finding
Stored HTML Injection in Generated Project Boards
- Content
View full analysis
{project['name']} - 项目看板 ...📊 {project['name']}
......{t['name']}负责人: {t.get('assignee', '未分配')} | 截止: {t.get('endDate', '未设置')}{t['name']}负责人: {t.get('assignee', '未分配')}...``` ### Technical Analysis The HTML board generator interpolates project data directly into an HTML document without context-appropriate escaping. Untrusted fields include the project name, task name, assignee, end date, blockers, and progress value. Several of these fields can be supplied through normal command-line operations and are persisted in project JSON files. An attacker able to influence project data can inject arbitrary HTML elements or event handlers. The payload becomes persistent because it is stored in the project data and reproduced whenever an HTML board is generated. For example, a task name containing the following value would be inserted directly into the document: ```html{t['name']}负责人: {t.get('assignee', '未分配')}阻塞: {', '.join(t.get('blockers', []))}- Remediation
View remediation
``` 5. Validate the complete loaded project schema before rendering it, even when the JSON file is expected to have been created by another project script. ]]>