T09 · Insecure Skill Coding Practices
Error
- Location
scripts/chart.sh:126- Finding
Persistent HTML and SVG Script Injection Through Unescaped Chart Content
- Content
View full analysis
{}'.format(svg_w/2, title)) for i, (label, val) in enumerate(pairs): x = margin_left + gap + i * (bar_w + gap) bar_h = (val / max_val * chart_h) if max_val > 0 else 0 y = margin_top + chart_h - bar_h color = colors[i] val_str = str(int(val)) if val == int(val) else "{:.1f}".format(val) parts.append(''.format(x, y, bar_w, bar_h, color)) parts.append('{}'.format(x + bar_w/2, y - 6, val_str)) parts.append('{}'.format(x + bar_w/2, margin_top + chart_h + 20, label)) ``` Equivalent unescaped interpolation is present in the pie and line SVG generators: ```python parts.append('{}'.format(svg_w/2, title)) ``` ```python parts.append('{} ({:.1f}%)'.format(legend_x + 20, ly + 12, label, pct)) ``` ```python parts.append('{}'.format(x, margin_top + chart_h + 20, labels[i])) ``` The HTML gen ...[truncated 3862 chars]- Remediation
View remediation
` elements. - HTML heading elements. - SVG chart titles. - SVG axis labels. - SVG legends. - Any future SVG attributes populated from user input. 3. Prefer an XML or HTML construction library that creates text nodes and escapes their contents automatically rather than assembling markup through string formatting. 4. Validate color schemes and other attribute values using strict allowlists. Continue parsing numeric values as numbers rather than inserting arbitrary strings. 5. Consider applying a restrictive Content Security Policy to generated HTML as defense in depth: ```html ``` 6. Add regression tests covering titles and labels containing `<`, `>`, `&`, quotes, closing tags, script elements, event-handler attributes, and malformed Unicode. Verify that generated files contain encoded text rather than executable elements. ]]>