T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_worksheet.py:64- Finding
Unescaped User Input Allows HTML and JavaScript Injection in Generated Worksheets
- Content
View full analysis
{a["id"]}. {a["title"]}' f'{a["instruction"]}{a["html"]}' ) body = f'{cards}' ans_block = "" if with_answers: li = "".join(f"- {a['id']}. {a['title']}：{a['answer']}
" for a in activities) ans_block = f'' n = len(activities) name_html = f'{name}' if name else ' ' ``` The untrusted command-line value reaches this function without sanitization: ```python html = render_html(args.name, level, activities, args.columns, not args.no_answers, lang, args.score) ``` ### Technical Analysis The `--name` command-line argument is user-controlled. Its value is passed as `args.name` to `render_html()` and interpolated directly into an HTML element without contextual output encoding. Because characters such as `<`, `>`, `"`, `'`, and `&` are not escaped, the name can terminate the intended text context and introduce arbitrary HTML elements or event-handler attributes. For example, a supplied value such as: ```html{T["answer_title"]}
- {li}
``` would be written as active markup into the generated worksheet rather than displayed as literal text. The payload executes when the generated HTM ...[truncated 1378 chars]
- Remediation
View remediation
{safe_name}' if safe_name else ' ' ) ``` Additional hardening measures: 1. Treat every future user-controlled field as untrusted and encode it according to its output context. 2. Avoid inserting user input into script, style, attribute, or URL contexts. 3. Add regression tests covering `<`, `>`, `&`, single quotes, double quotes, closing tags, and event-handler payloads. 4. Verify that a value such as `