T09 · Insecure Skill Coding Practices
Error
- Location
assets/search.py:382- Finding
Generated HTML Reports Permit Script and Markup Injection
- Content
View full analysis
``` `assets/report_template.html:538-542`: ```javascript const INITIAL_DATA = {{INITIAL_DATA}}; // ─── 状态 ──────────────────────────────────────────────────────────────────── let currentKeyword = '{{KEYWORD}}'; let currentOffset = 0; ``` `assets/report_template.html:640-652`: ```javascript const card = document.createElement('a'); card.className = 'article-card'; card.href = url; card.target = '_blank'; card.rel = 'noopener noreferrer'; card.innerHTML = `${avatarHTML}${escapeHTML(title)}${escapeHTML(author)} ``` `assets/report_template.html:770-774`: ```javascript fallbackArticles.slice(0, 5).map(function(a) { return '' + escapeHTML(a.title || '无标题') + ' — ' + (a.author || '') + ''; }).join(''); ``` ### Technical Analysis The report generator performs direct string substitution into several different parsing contexts: - An HTML attribute - A Java ...[truncated 3195 chars]- Remediation
View remediation
``` Populate its `textContent` through a trusted template engine or escape at least `<`, `>`, `&`, U+2028, and U+2029 before embedding serialized JSON. 3. Avoid inserting the keyword into inline JavaScript. Read it from a safely populated DOM element or encode it with a JavaScript-string encoder. 4. Encode values according to their exact context: - HTML attribute encoding for `value` - JavaScript-string encoding for script literals - HTML text encoding for visible content - URL validation for links and images 5. Replace `innerHTML` construction with `document.createElement()`, `textContent`, and `setAttribute()` using validated values. 6. Permit only `https:` and, if necessary, `http:` URLs. Reject `javascript:`, `data:`, `file:`, and unknown schemes. 7. Validate remote cover-image URLs separately and restrict them to expected HTTPS hosts if practical. 8. Add a restrictive Content Security Policy that blocks inline scripts, object embedding, and unexpected network destinations. 9. Add regression tests using quotes, angle brackets, ``, event-handler markup, and dangerous URL schemes. ]]>