T09 · Insecure Skill Coding Practices
Error
- Location
exam_analyzer.py:744- Finding
Stored HTML Injection in Generated Report
- Content
View full analysis
{self.class_name} - 期末试卷分析报告 ``` The same untrusted value is inserted directly into the page body: ```python``` Spreadsheet column names are inserted directly into table cells: ```python html_content += f""" {q} {stats['得分率']:.1f} {stats['难度']:.3f} {stats['区分度']:.3f} {evaluation} """ ``` Untrusted column names are also concatenated into recommendation text: ```python if low_score_questions: html_content += f"""📊 {self.class_name}
期末试卷深度分析报告
生成时间：{datetime.now().strftime('%Y年%m月%d日')}
📌 重点讲解内容：""" ``` ### Technical Analysis `self.class_name` originates from the second command-line argument, while `q` and the values in `low_score_questions` originate from spreadsheet or CSV column names. These values are attacker-controlled when a user processes an untrusted file or uses an untrusted class name. The application interpolates these values into an HTML document without context-appropriate escaping. Consequently, markup characters such as `<`, `>`, `"`, and `'` retain their HTML meaning. An attacker can close the intended text context and add arbitrary elements or event handlers. Because the generated HTML is intended to be opened in a browser or copied into a publishing platform, the injected payload becomes active when the output is vie ...[truncated 1917 chars]
以下题目得分率较低，需要在教学中加强讲解：{', '.join(low_score_questions)}- Remediation
View remediation
``` 6. Add regression tests with payloads in both the class name and spreadsheet headers. Confirm that payloads appear as literal text and cannot create DOM elements or event handlers. ]]>