T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_enhanced_report.py:799- Finding
HTML and JavaScript Injection in the Enhanced Report Generator
- Content
View full analysis
' for node in flow_analysis['flow_map']: flow_html += f'{node["dominant_type"][:3]}·P{node["idx"]}' flow_html += '→' flow_html = flow_html.rstrip('→') + '' gap_html = '' for g in flow_analysis['gaps']: gap_html += f'P{g["from_idx"]}→P{g["to_idx"]}{g["gap"]}{g["preview"]}' ``` ```python html = f""" 论文修改建议报告 · 增强版 · {html_mod.escape(paper_title[:40])} {CSS_V3}▸ 论文润色修改建议报告 v3.0 · 三级交互增强版 ◂{html_mod.escape(paper_title[:60])}
15维度全面诊断 · 三级交互 · 修改会话模式
📅 {now}📋 PR-{report_id}🏫 {journal_name}📏 {target_words}字""" ``` Additional unescaped uses include: ```python{journal_name}投稿要求逐项映射检查
``` ```pythonPR-{report_id} · {now} · 目标期刊: {journal_name}``` ### Technical Analysis The generator combines unt ...[truncated 2406 chars]- Remediation
View remediation
... ``` Parse the data once and attach handlers with `addEventListener`. 3. Avoid inline `onclick` attributes and dynamic `innerHTML`. Use `textContent`, `createElement`, and explicit DOM property assignment. 4. When embedding JSON inside a script element, escape characters that can terminate the element, particularly `<`, `>`, `&`, and the sequence ``. 5. Add a restrictive Content Security Policy, preferably disallowing inline script execution: ```html ``` 6. Add automated tests using payloads containing quotes, closing tags, event handlers, ``, and SVG markup. ]]>