T09 · Insecure Skill Coding Practices
Error
- Location
scripts/analyze_repo.py:688- Finding
Stored HTML Injection in Generated Audit Reports
- Content
View full analysis
Forensic Repository Analysis | Repository:{analysis.repo_path}``` ```python {''.join(f''' {r['severity'].upper()} {r['type']}{r['module']}{r['risk_score']} {r['description']} ''' for r in risk_entries)} ``` ```python {''.join(f'{d["name"]}{d.get("version", "N/A")}{d.get("type", "runtime")}{d.get("ecosystem", "unknown")}' for d in dep_list[:30])} ``` ```pythonTest Case {i}: {test_case['title']}``` ### Technical Analysis The HTML report generator uses direct string interpolation for values derived from the repository being analyzed. These values include: - The repository path - Module and file paths - Dependency names and versions - Risk descriptions - Generated test-case content No HTML encoding or context-sensitive sanitization is applied before these values are inserted into element bodies and `text {test_case['example']}Validation: {test_case['validation']}
` blocks. Consequently, characters such as `<`, `>`, `"`, and `'` retain their HTML meaning. A malicious repository can provide crafted filenames or dependency metadata containing markup such as: ```html``` The payload is stored in the generated HTML report. It may execute when a user opens that report in a browser. Wrapping an attacker-controlled value in `
` or `text ` does not neutralize HTML because those elements still parse nested markup. This flaw is particularly significant ...[truncated 1642 chars]
- Remediation
View remediation
``` Avoid allowing inline scripts, remote scripts, frames, form submission, or unrestricted network connections. 5. Ensure content placed inside `text ` and `
` elements is also escaped. These elements do not provide an HTML security boundary. 6. Add regression tests that generate reports from repository values such as: ```text