T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_html.py:218- Finding
Stored Cross-Site Scripting in the Generated HTML Report
- Content
View full analysis
{cat}\n' html += f'''搜索重置显示 {len(items)} / {len(items)} 条- Remediation
View remediation
`, then parse its text content. Before embedding JSON in HTML, escape characters significant to the HTML parser, including `<`, `>`, and `&`. ```python serialized_items = json.dumps(items, ensure_ascii=False) serialized_items = ( serialized_items .replace('&', '\\u0026') .replace('<', '\\u003c') .replace('>', '\\u003e') ) ``` 3. **Apply context-specific HTML escaping** to values written into server-generated markup, including dates and category names. ```python from html import escape safe_cat_text = escape(str(cat)) safe_cat_attr = escape(str(cat), quote=True) html += f'{safe_cat_text}' ``` 4. **Validate links before assigning them.** Parse each URL and allow only HTTPS links to the expected Baidu host. Reject unsafe schemes such as `javascript:` and `data:`. 5. **Add `rel="noopener noreferrer"`** to links opened with `target="_blank"`. 6. **Deploy a restrictive Content Security Policy.** Prefer external JavaScript and disallow inline script execution, for example with a policy based on `script-src 'self'`. A CSP should be defense in depth rather than a substitute for output encoding. 7. **Validate upstream fields.** Enforce expected types, reasonable maximum lengths, and allowed category values before persistence. 8. **Add regression tests** using payloads containing ``, quotes, HTML closing tags, event-handler attributes, and unsafe URL schemes. Verify that generated reports display these payloads as inert text. ]]>