T09 · Insecure Skill Coding Practices
Error
- Location
src/reporters/html_reporter.py:243- Finding
Unescaped Repository Metadata Enables Stored HTML Injection and Unsafe PDF Resource Retrieval
- Content
View full analysis
📁 {{ repo_name }} {% set all_authors = [] %} {% for key, analyzer_data in repo_metrics.items() %} {% if key != 'evaluations' and analyzer_data is mapping %} {% for author in analyzer_data.keys() %} {% if author not in all_authors %} {% if all_authors.append(author) %}{% endif %} {% endif %} {% endfor %} {% endif %} {% endfor %} {% for author in all_authors | sort %}👤 {{ author }}
``` ```python class HtmlReporter(BaseReporter): """Generates styled HTML reports from analysis metrics.""" def generate(self, metrics: Dict) -> str: """Generate an HTML report using Jinja2 template.""" template = Template(HTML_TEMPLATE) return template.render(metrics=metrics) ``` The resulting unescaped HTML is subsequently passed to several PDF rendering engines: ```python def generate_to_file(self, metrics: Dict, output_path: str) -> str: """ Generate a PDF report and write it to a file. Args: metrics: Analysis metrics dict. output_path: Path to write the PDF file. Returns: The output file path. """ # Try HTML-to-PDF engines first for best visual quality html_content = self.generate(metrics) for method in [ self._try_weasyprint, self._try_pdfkit, self._try_xhtml2pdf, ]: try: return method(html_content, output_path) except (ImportError, Exception) as e: logger.debug("PDF method failed: %s", e) continue # Fall back to reportlab (always available) ...[truncated 3719 chars]- Remediation
View remediation