T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/skill_chatbot.py:311- Finding
Stored DOM-Based Cross-Site Scripting in Web Search Results
- Content
View full analysis
`; html += `${func.name} ${func.category}
`; html += `描述: ${func.description}
`; html += `语法: ${func.syntax}`; if (func.parameters.length > 0) { html += `参数:`; } html += `- `;
func.parameters.forEach(function(p) {
const required = p.required ? '必填' : '可选';
html += `
- ${p.name}: ${p.description} (${p.type}, ${required}) `; }); html += `
返回类型: ${func.return_type}
`; if (func.example) { html += `示例:\n${func.example}`; } if (func.notes) { html += `注意: ${func.notes}
`; } html += ``; }); document.getElementById('results').innerHTML = html; ``` ### Technical Analysis The browser interpolates API database fields directly into an HTML string and assigns the result to `innerHTML`. No contextual output encoding or HTML sanitization is applied to fields such as `name`, `category`, `description`, `syntax`, parameter properties, `return_type`, `example`, or `notes`. These fields originate from a JSON database loaded by the server. The command-line interface permits the operator to select a database using `--db`, so the database cannot always be treated as trusted. An attacker-controlled value such as an image element with an `onerror` handler would be parsed as active HTML when a matching search result is displayed. The ...[truncated 1539 chars]- Remediation
View remediation