T09 · Insecure Skill Coding Practices
Error
- Location
scripts/report_html.py:347- Finding
Stored HTML and JavaScript Injection in Generated Reports
- Content
View full analysis
Review Analysis Report - {asin} ``` ```python📊 Review Authenticity Analysis
ASIN: {asin}Summary: {summary}``` ```python{d.get('status', '❓')}{d.get('name', d.get('name_zh', ''))}{d.get('score', 0):.0f}/100``` ```python{d.get('detail', d.get('detail_zh', ''))}``` ```javascript const suspicious = {suspicious_json}; const container = document.getElementById('suspiciousReviews'); if (suspicious.length === 0) { container.innerHTML = 'No highly suspicious reviews detected.
'; } else { suspicious.slice(0, 5).forEach((review, index) => { container.innerHTML += `#${index + 1} Risk: ${review.risk_score?.toFixed(0) || 'N/A'}%"${review.content}"Reasons ...[truncated 2589 chars]- Remediation
View remediation
`, `&`, U+2028, and U+2029 safely encoded. 3. Replace `innerHTML` and template-based markup assembly with DOM APIs that assign untrusted values through `textContent`: ```javascript const content = document.createElement('div'); content.className = 'suspicious-content'; content.textContent = `"${review.content}"`; item.appendChild(content); ``` 4. Validate structured fields before rendering: - Restrict `risk_level` and status values to explicit allowlists. - Require scores and review counts to be numeric and within expected ranges. - Apply maximum lengths to textual report fields. 5. Add a restrictive Content Security Policy to generated reports. Avoid inline scripts where practical and disallow unneeded remote origins. 6. Add regression tests containing HTML elements, event-handler attributes, quotes, backticks, ``, Unicode separators, and malformed JSON strings. ]]>