T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/genome_report.py:184- Finding
Stored HTML Injection in Generated Genome Reports
- Content
View full analysis
genotype.""" genotypes = {} with open(filepath) as f: for line in f: line = line.strip() if not line or line.startswith("#"): continue parts = line.split("\t") if len(parts) >= 4: rsid, _chrom, _pos, genotype = parts[0], parts[1], parts[2], parts[3] if rsid.startswith("rs") and genotype != "--": genotypes[rsid] = genotype return genotypes ``` The genotype and input filename are then inserted directly into an HTML document: ```python def output_html(results, scores, filename, output_path=None): cats_html = "" for cat in sorted(scores, key=scores.get, reverse=True): label = CATEGORY_LABELS.get(cat, cat) score = scores[cat] color = risk_color(score) cats_html += f'\n' details_html = "" for cat, snps in sorted(results.items()): label = CATEGORY_LABELS.get(cat, cat) rows = "" for s in sorted(snps, key=lambda x: -x["risk_count"]): cls = "risk-high" if s["risk_count"] == 2 else "risk-med" if s["risk_count"] == 1 else "risk-low" rows += f'{s["rsid"]}{s["gene"]}{s["genotype"]}{s["trait"]}{s["effect"]}\n' ...[truncated 3966 chars]{label}
{score}% — {risk_label(score)}- Remediation
View remediation
{escape(str(member), quote=True)}" for member in members ) ``` 3. Validate genome fields before storing them. For ordinary diploid SNP calls, enforce an explicit allowlist: ```python import re if re.fullmatch(r"[ACGT]{1,2}", genotype): genotypes[rsid] = genotype ``` If the supported input format includes insertions, deletions, haploid calls, or other notation, define a documented allowlist that covers only those formats. 4. Prefer a templating system with automatic escaping if external dependencies become acceptable. If string construction remains in use, centralize escaping in a helper so no output field can bypass it. 5. Add a restrictive Content Security Policy as defense in depth, for example: ```html ``` Escaping remains mandatory because a CSP alone does not prevent markup injection or report manipulation. 6. Add regression tests using malicious genotype values and filename stems. Verify that generated reports contain encoded text such as `<img` and never preserve executable elements or event-handler attributes. ]]>