T09 · Insecure Skill Coding Practices
Error
- Location
scripts/report_html.py:365- Finding
Stored Cross-Site Scripting in Generated HTML Reports
- Content
View full analysis
Review Analysis Report - {asin} ``` ```htmlASIN: {asin}``` ```htmlSummary: {summary}``` ```javascript // SuspiciousReview const suspicious = {suspicious_json}; const container = document.getElementById('suspiciousReviews'); if (suspicious.length === 0) {{ container.innerHTML = 'No highly suspicious reviews detected.
'; }} else {{ suspicious.slice(0, 5).forEach((review, index) => {{ container.innerHTML += ``; }}); }} ``` Dimension names and details are also interpolated directly into the document: ```python {"".join([f'''#${{index + 1}} Risk: ${{review.risk_score?.toFixed(0) || 'N/A'}}%"${{review.content}}"Reasons: ${{(review.reasons || review.reasons_zh || []).join(', ')}}{d.get('status', '❓')}{d.get('name', d.get('name_zh', ''))}{d.get('score', 0):.0f}/100- Remediation
View remediation
` element. Prefer placing JSON in a non-executable element and escaping HTML-significant characters: ```python safe_json = json.dumps(data, ensure_ascii=False) safe_json = ( safe_json.replace("&", "\\u0026") .replace("<", "\\u003c") .replace(">", "\\u003e") ) ``` Alternatively, generate the DOM entirely from safely encoded server-side HTML. 4. Add a restrictive Content Security Policy. If inline scripts are removed, an example baseline is: ```html ``` 5. Validate structured inputs and enforce expected scalar types for risk scores, names, details, reasons, and review content. 6. Add regression tests containing payloads such as ``, ``, quotes, backticks, ampersands, and Unicode line separators. Confirm that the generated report displays them only as text. ]]>