T09 · Insecure Skill Coding Practices
Error
- Location
create_hot_publish_page.py:609- Finding
Persistent HTML and JavaScript Injection Through Unescaped User Input
- Content
View full analysis
{content["title"]} ``` ```python # Add tags for tag in content['tags']: hot_class = 'hot-tag' if '热点' in tag or '热门' in tag else '' sections_html += f'#{tag}\n' ``` Only the main content body receives HTML escaping: ```python{self._escape_html(content["content"])}``` ### Technical Analysis The constructor accepts `theme` and `brand_name` as strings and only removes leading and trailing whitespace. These values are subsequently used in generated titles, tags, and direct template placeholder replacement. No context-appropriate escaping is applied before the values are inserted into HTML text contexts. Although `_escape_html()` exists, it is only used for the generated content body. It does not protect the document title, brand subtitle, generated content titles, or tags. For example, a malicious brand value can terminate the fallback template's `` element: ```html ``` When this value replaces `{{BRAND_NAME}}`, the resulting saved document contains executable attacker-controlled JavaScript. A malicious theme can also reach generated title and tag elements and inject arbitrary HTML. The payload is p ...[truncated 1720 chars]- Remediation
View remediation
` element and parse its text content. 5. Add a restrictive Content Security Policy to generated documents where practical. Avoid allowing inline scripts if the full template is restored. 6. Add regression tests using hostile inputs such as: ```python '' '' '">' '' ``` The tests should verify that these values appear only as encoded text and do not create executable elements. ]]>