T09 · Insecure Skill Coding Practices
- Location
scripts/generate.py:681- Finding
Stored HTML and Script Injection Through Unescaped Report Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate.py, lines 681-694
Vulnerability Type: Stored HTML injection / cross-site scripting
Risk Level: HighVulnerable Code
python def _concepts_html(concepts): """Format concept labels for HTML display.""" if not concepts: return '' parts = [p.strip() for p in concepts.split('.') if p.strip()] if not parts: return '' html = f'<span style="color:#d29922;font-weight:600;">{parts[0]}</span>' for p in parts[1:]: html += f' <span style="color:#8b949e;font-size:11px;background:#21262d;padding:1px 6px;border-radius:3px;">{p}</span>' return htmlThe same unsafe interpolation pattern is used throughout report generation. For example, fields such as stock names, codes, reasons, tags, market summaries, source labels, and date labels are inserted directly into HTML fragments without contextual escaping.
Technical Analysis
Values loaded from
report_data.jsonare treated as trusted HTML even though the documented workflow populates them from external market-data services._concepts_html()places each concept string directly between HTML tags. It does not callhtml.escape(), sanitize markup, or validate the field against a restricted character set.An attacker who can influence a remote data response, the intermediate JSON file, or an upstream connector can supply markup such as:
json { "concepts": "MarketTheme.<img src=x onerror=\"alert(document.domain)\">" }This becomes active markup in the generated report:
html <span style="color:#d29922;font-weight:600;">MarketTheme</span> <span style="..."><img src=x onerror="alert(document.domain)"></span>Because the output is an HTML file intended to be delivered and opened by a user, the payload executes when the report is viewed in a browser. The static template does not establish a Content Security Policy th ...[truncated 1625 chars]
- Remediation
View remediation
Remediation Suggestions
-
Escape every untrusted value at the point where it is inserted into HTML:
python from html import escape def html_text(value): return escape(str(value), quote=True)Apply this helper to
concepts, stock names, codes, reasons, labels, summaries, dates, source names, and every other string obtained from JSON or external services. -
Correct
_concepts_html()as follows:python from html import escape def _concepts_html(concepts): if not concepts: return '' parts = [p.strip() for p in str(concepts).split('.') if p.strip()] if not parts: return '' result = ( '<span style="color:#d29922;font-weight:600;">' f'{escape(parts[0])}</span>' ) for part in parts[1:]: result += ( ' <span style="color:#8b949e;font-size:11px;' 'background:#21262d;padding:1px 6px;border-radius:3px;">' f'{escape(part)}</span>' ) return result -
Prefer an auto-escaping template engine such as Jinja2 rather than assembling HTML with f-strings. Only explicitly mark constant, developer-authored fragments as safe.
-
Validate structured fields. For example, stock codes should match an expected character pattern, dates should be parsed as dates, and numeric values should reject non-numeric input.
-
Add a restrictive Content Security Policy, preferably via an HTTP header when hosted. For standalone reports, a suitable meta policy can provide partial defense in depth:
html <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; img-src data:;"> -
Add automated tests containing payloads such as
<script>,<img onerror>, quotation marks, ampersands, and closing tags, and verify that the output contains encoded text rath ...[truncated 26 chars]
-