T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:43- Finding
Stored JavaScript Injection Through Unsafe Report Data Embedding and DOM Rendering
- Content
View full analysis
${dir.name}${isBig?' 大户':''} ${fmtSize(dir.size_gb)} ${pct}% `; ``` ```javascript${loc.path}``` ### Technical Analysis The scanner co ...[truncated 3480 chars]- Remediation
View remediation
SAFE_JSON ``` Before insertion, serialize the data and escape at least `<`, `>`, `&`, U+2028, and U+2029. For example: ```python json_str = json.dumps(data, ensure_ascii=False, separators=(",", ":")) json_str = ( json_str .replace("&", "\\u0026") .replace("<", "\\u003c") .replace(">", "\\u003e") .replace("\u2028", "\\u2028") .replace("\u2029", "\\u2029") ) ``` Read it using `textContent` and `JSON.parse()`: ```javascript const REPORT_DATA = JSON.parse( document.getElementById("report-data").textContent ); ``` 3. **Eliminate untrusted `innerHTML` construction** Build report elements with DOM APIs and assign filesystem-derived values through `textContent`: ```javascript const cell = document.createElement("td"); cell.textContent = dir.name; row.appendChild(cell); ``` Static markup may be created separately, but directory names, paths, hostnames, and all other scan-derived values must never be concatenated into HTML. 4. **Use contextual sanitization where HTML is unavoidable** If rich HTML rendering cannot be removed, process generated markup with a well-maintained HTML sanitizer configured to reject script elements, event-handler attributes, unsafe URLs, SVG scripting, and other active content. Encoding remains preferable when values are intended to be plain text. 5. **Add security regression tests** Generate and open reports ...[truncated 609 chars]