T09 · Insecure Skill Coding Practices
Error
- Location
scripts/diff_report.py:348- Finding
Stored HTML Injection in Generated Diff Reports
- Content
View full analysis
` element. The code attempts to prevent premature termination of that element by replacing ``, ``, or `` therefore remain intact. An attacker-controlled compared file can contain a mixed-case closing tag followed by active HTML, for example: ```html``` When the report is opened, the browser terminates the JSON script element at the mixed-case closing tag and parses the following markup as HTML. The injected event handler then executes in the generated report's browser context. JSON string escaping does not prevent this issue because the HTML parser identifies the closing script tag before JavaScript or JSON parsing semantics are applied. ### Attack Path 1. An attacker creates or modifies a source, configuration, text, or HTML file that will be included in a diff. 2. The attacker inserts a mixed-case closing script tag followed by executable HTML. 3. A user invokes `scripts/diff_report.py` with that file as either the old or new input. 4. The generator ser ...[truncated 931 chars]
- Remediation
View remediation
` - `` - `` - Closing-tag text split across compared lines - Injected tags with event handlers 5. Open generated reports in a sandboxed preview context where available. ]]>