T09 · Insecure Skill Coding Practices
Error
- Location
generate.py:91- Finding
Stored Cross-Site Scripting Through Unsanitized Input Data
- Content
View full analysis
{{TITLE}} ``` ```html``` ```javascript function fillCard(d){ const s = TYPE_STYLE[d.type]; tooltip.innerHTML = `{{TITLE}}
{{SUBTITLE}}
${d.year}${s.label}` + `${d.title}
` + `${d.loc}` + `${d.desc}` + `` + `Wikipedia ↗` + `Baidu Baike ↗` + ``; } ``` ### Technical Analysis Input JSON is treated as trusted markup and executable script data. The `m ...[truncated 2656 chars]- Remediation
View remediation
` element, with HTML-safe serialization, and parse its `textContent`. 5. Validate `wiki` and `baike` URLs against an explicit `https:` allowlist. Reject `javascript:`, `data:`, and other unexpected schemes. 6. Validate milestone field types and impose reasonable length limits. 7. Add a restrictive Content Security Policy that disallows inline scripts and event handlers. CSP should be defense in depth rather than the primary fix. 8. Add tests using payloads containing HTML event handlers, quotes, backticks, and literal `` strings. ]]>