T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_report.py:70- Finding
Unescaped Template Substitution Enables HTML and Script Injection in Generated Reports
- Content
View full analysis
{s}' for s in signals ) if lang == "cn": for detail in data.get("pick_details", []): if detail.get("pattern_label"): detail["pattern_label"] = LABEL_CN.get(detail["pattern_label"], detail["pattern_label"]) return data def render_simple(template, data): """Simple template rendering: {{key}} replacement + {{#each list}}...{{/each}} single-level loop""" def replace_each(match): key = match.group(1) block = match.group(2) items = data.get(key, []) parts = [] for item in items: rendered = block if isinstance(item, dict): for k, v in item.items(): if isinstance(v, (str, int, float)): rendered = rendered.replace("{{" + k + "}}", str(v)) else: rendered = rendered.replace("{{this}}", str(item)) parts.append(rendered) return "\n".join(parts) output = re.sub( r'{{#each (\w+)}}(.*?){{/each}}', replace_each, template, flags=re.DOTALL ) # Replace top-level {{key}} variables for k, v in data.items(): if isinstance(v, (str ...[truncated 3029 chars]- Remediation
View remediation
` elements. - Event-handler attributes such as `onerror`. - Quotes that escape `href` attributes. - `javascript:` and `data:` URLs. - HTML embedded in repository descriptions, issue titles, signals, and analysis fields. 8. Escape Markdown table delimiters and link destinations independently when generating Markdown reports. ]]>