T09 · Insecure Skill Coding Practices
Error
- Location
scripts/analyze.py:583- Finding
Stored Cross-Site Scripting in Generic Analysis Reports
- Content
View full analysis
``).join(''); ``` ```javascript function topRowHtml(r){ const gid=gidOf(r), sel=selected.has(gid), expanded=!!r.expanded; const hasCh = TREE_ON && r.childIdx && r.childIdx.length>0; const vis=visCols(); const chevIdx=(DATE_IDX>=0 && !hiddenCols.has(DATE_IDX)) ? DATE_IDX : (vis.length?vis[0]:0); let tds=vis.map(i=>{ const v=r.cells[i], numeric=META[i].type==='metric'; let inner=(numeric&&typeof v==='number')?fmt(v):v; if(i===chevIdx && hasCh) inner=`▸`+inner; return `${inner}`; }).join(''); let h=`${tds}`; if(hasCh && expanded) h+=r.childIdx.map(ix=>childRowHtml(REPORT.rows[ix])).join(''); return h; } ``` ```python repor ...[truncated 2101 chars]${s.name}${s.is_pct?' (%)':''}${s.is_pct?'均值':'合计'}${fmt(s.is_pct?s.mean:s.sum)}均值${fmt(s.mean)}最大值${fmt(s.max)}最小值${fmt(s.min)}- Remediation
View remediation
... ``` Before insertion, encode at least `<`, `>`, `&`, U+2028, and U+2029. Parse the value from the element's `textContent`. 3. Prefer creating DOM elements and assigning workbook values through `textContent`. 4. Avoid using `innerHTML` for column names, cells, suggestions, summaries, or anomaly descriptions. 5. If HTML construction is unavoidable, use separate, context-aware encoders for HTML text and HTML attributes. 6. Remove the incomplete `esc()` function or replace it with a rigorously tested contextual encoding implementation. 7. Add regression tests containing payloads in cells and headers, including: ```html"> ``` ]]>