T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_reports.py:585- Finding
Stored JavaScript Injection in Generated HTML Dashboards
- Content
View full analysis
{ const row = tableBody.insertRow(); row.innerHTML = ` ${index + 1} ${product.asin} ${product.title} ${product.brand} $${product.price} ${product.rating} ${product.sales} ${product.marketShare}% `; }); ``` ### Technical Analysis Product titles, brands, ASINs, seller-source values, and trend fields can originate from the external Sorftime API or from a user-supplied JSON file. These fields are se ...[truncated 2114 chars]- Remediation
View remediation
... ``` Parse it with: ```javascript const reportData = JSON.parse( document.getElementById('report-data').textContent ); ``` 3. Before embedding JSON into HTML, escape at least `<`, `>`, `&`, U+2028, and U+2029. In particular, encode `<` as `\u003c` so `` cannot terminate the element. 4. HTML-escape category names, site values, and all other variables inserted into normal HTML contexts. 5. Add a restrictive Content Security Policy that blocks inline event handlers and limits script sources. Prefer external, locally hosted scripts with nonce- or hash-based authorization. 6. Add regression tests using values containing ``, ``, quotation marks, backticks, and Unicode line separators. ]]>