T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/chart.sh:123- Finding
Unescaped User Input in Generated SVG and HTML Files
- Content
View full analysis
{}'.format(svg_w/2, title)) ``` ```python parts.append('{}'.format(x + bar_w/2, margin_top + chart_h + 20, label)) ``` The HTML generator similarly inserts the title and generated label markup without escaping: ```python svg_bars.append( ' ' '{label}\n' ' \n' ' {val}'.format( ty=y + bar_height // 2 + 5, label=label, ry=y, w=w, h=bar_height, color=color, tx=w + 108, val=val_str ) ) ``` ```python html = """ {title} ...""".format( title ...[truncated 3103 chars]{title}
{bars}- Remediation
View remediation
{}'.format( svg_w / 2, html.escape(title, quote=True) ) ) ``` 3. Replace string-based document construction with a standard XML or HTML builder where practical. For SVG, `xml.etree.ElementTree` can create text nodes without requiring manual markup concatenation. 4. Apply equivalent encoding in `scripts/script.sh`. If shell-based SVG generation is retained, invoke a dedicated escaping function or pass values to a safe XML-generation utility rather than interpolating raw shell variables into markup. 5. Continue parsing numeric values as numeric types and reject non-finite values such as `NaN` and infinity. Keep chart type and color scheme values restricted to explicit allowlists. 6. Add regression tests for titles and labels containing XML metacharacters, closing tags, event-handler markup, and script-like content. Tests should confirm that these inputs appear only as encoded text and cannot create additional document elements. 7. For generated HTML, consider adding a restrictive Content Security Policy, such as disabling scripts and remote resource loading. This should be treated as defense in depth and not as a replacement for output encoding. 8. Document that generated files may contain untrusted data and should not be opened or hosted under a sensitive trusted origin unless they have been safely encoded. ]]>