T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/preview_generator.py:187- Finding
Stored HTML Injection in Generated Preview Pages
- Content
View full analysis
{title} - {hex_color} ``` ```python``` The palette preview contains the same unsafe interpolation: ```python html = f''' {palette_title} ``` ```python{title}
{color_info["name"]} - {color_info["temperature"]} / {color_info["family"]}{palette_title}
Color Toolkit 自动生成
``` A user-controlled recommendation description is propagated into `palette_title`: ```python html_content = generate_palette_page_html( palette_colors, palette_title=f"配色方案 - {description}", output_path=output_path ) ``` ### Technical Analysis The preview generator constructs HTML using Python formatted strings and inserts `title` or `palette_title` without HTML escaping. These values can originate from the CLI `--title` argument or from the free-form recommendation description. Because the values are inserted into both element text and the HTML document title, an attacker can provide markup that closes the current element and introduces new HTML elements or executable JavaScript. For example, a description containing a closing tag followed by a script element would be written verbatim into the generated file. Th ...[truncated 1578 chars]- Remediation
View remediation
{safe_title} - {hex_color}{safe_title}
``` 3. Prefer a template engine configured with automatic HTML escaping rather than manually constructing complete documents with formatted strings. 4. Keep contextual encoding requirements separate: - Use HTML text escaping for element contents. - Use attribute escaping for attribute values. - Continue strictly validating values inserted into CSS. 5. Add regression tests using payloads that contain: - Closing HTML tags. - Script elements. - Event-handler attributes. - Quotes and angle brackets. - Encoded and mixed-case markup. 6. Consider applying a restrictive Content Security Policy to generated previews, such as disabling scripts when no JavaScript is required: ```html ``` ]]>