T09 · Insecure Skill Coding Practices
Error
- Location
scripts/article_builder.py:87- Finding
Stored HTML and JavaScript Injection in Generated Article Previews
- Content
View full analysis
\n" in_list = False html_content += f'{stripped[3:]}
\n' elif stripped.startswith("### "): if in_list: html_content += "\n" in_list = False html_content += f'{stripped[4:]}
\n' # Lists elif stripped.startswith("- ") or stripped.startswith("* "): if not in_list: html_content += "- \n"
in_list = True
html_content += f'
- {stripped[2:]} \n' elif re.match(r'^\d+\.\s', stripped): if not in_list: html_content += "
- {re.sub(r"^\d+\.\s", "", stripped)} \n' # Quotation elif stripped.startswith(">"): if in_list: html_content += "
- \n"
in_list = True
html_content += f'
{stripped[1:].strip()}
\n' # Image elif stripped.startswith("!["): alt_match = re.search(r'!\[(.*?)\]', stripped) src_match = re.search(r'\((.*?)\)', stripped) alt = alt_match.group(1) if alt_match else "" src = src_match.group(1) if src_match else "" html_content += f'{alt}\n' # Body else: if in_list: html_content += "\n" in_list = False formatted = line formatted = re.sub(r'\*\*(.*?)\*\*', r'\1', formatted) ...[truncated 3796 chars]
- Remediation
View remediation
` elements. - `` payloads. - Quote-breaking image URLs and alternative text. - Malicious headings, list entries, quotations, titles, and author names. - Unsafe URI schemes. 8. Document that article drafts are untrusted input and should not be rendered or opened until sanitization has completed. ]]>