T09 · Insecure Skill Coding Practices
Warning
- Location
references/visualization-template.md:15- Finding
Unescaped Dynamic Content in Generated HTML and JavaScript
- Content
View full analysis
{report title} ``` ```html📊 {report title}
{time range} | Mock Data
Total Orders{value}Total Revenue{value}Daily Avg{value}YoY Growth{value}📈 Trend
Category Distribution
Region Comparison
``` ### Technical Analysis The visualization template places report titles, time ranges, KPI values, generated insights, chart labels, and chart data dir ...[truncated 2215 chars]📋 Insights
- {insights}
- Remediation
View remediation
`, `"`, and `'`. 3. Do not interpolate generated insights as raw HTML. Create list elements programmatically and assign their contents through `textContent`. 4. Serialize chart labels and datasets with a trusted JSON serializer. Do not construct JavaScript arrays by concatenating strings. 5. If rich HTML insights are intentionally supported, process them through a maintained allowlist-based HTML sanitizer before insertion. 6. Add a restrictive Content Security Policy that blocks inline event handlers and limits outbound connections to approved destinations. Where practical, move initialization code to a reviewed local script. 7. Validate generated filenames separately to prevent path traversal or unsafe path characters. 8. Add tests using payloads containing closing tags, quotation marks, event handlers, and script-context terminators to verify that generated reports render them only as text. ]]>