T09 · Insecure Skill Coding Practices
Error
- Location
references/build.py:185- Finding
Stored HTML and JavaScript Injection in Generated Reports
- Content
View full analysis
{h}" html += "{cell}" for i, row in enumerate(rows): cls = " highlight" if row.get("highlight") else "" html += f"" for cell in row["cells"]: align = "right" if isinstance(cell, (int, float)) or (isinstance(cell, str) and cell.replace(".","").replace("-","").replace("+","").isdigit()) else "left" color = "" if isinstance(cell, str): if "+" in cell and "%" in cell: color = 'style="color:var(--red);font-weight:700"' elif "-" in cell and "%" in cell and cell.count("-") == 1: color = 'style="color:var(--green);font-weight:700"' elif cell.startswith(""): color = "" html += f"" html += "" ``` Peer comparison titles, headers, and cells have the same vulnerability: ```python peers_title = peers.get("title", "同行估值与业绩对比") html = f"""SEC 09 同行对比{h}""" for h in headers: html += f"" html += "" for row in rows: cls = "highlight" if row.get("highlight") else "" html += f'🏭 {peers_title}
- Remediation
View remediation
{esc(h)}" for row in rows: html += '' if row.get("highlight") else "{esc(cell)}" for cell in row.get("cells", []): html += f"" html += "" ``` 2. Escape peer comparison metadata: ```python html = f"""🏭 {esc(peers_title)}
""" ``` 3. Escape stock metadata and report dates: ```python stock_name = esc(data["stock"]["name"]) stock_code = esc(data["stock"]["code"]) safe_report_date = esc(report_date) ``` 4. Audit every formatted HTML string in `build.py`. All strings from JSON should be considered untrusted, including: - Stock metadata. - Table headers and cells. - Scores and advice. - Technical-analysis notes. - Survey metadata. - Valuation notes. - Peer comparison fields. - Report dates and footer values. 5. If limited formatting such as `` and `
` must be supported, use a centralized HTML sanitizer with a strict allowlist of tag names and attributes. Do not preserve arbitrary attributes or event handlers. 6. Prefer constructing the report through an auto-escaping template engine. Require an explicit safe-markup type for the small number of fields that intentionally support formatting. 7. Validate structured numeric fields separately. Enforce numeric ranges for percentages, bar widths, scores, and valuation percentiles before using them in CSS or calculations. 8. Add regression tests using payloads such as: ```html``` The generated report must contain escaped text and must not create executable elements. 9. Correct `SKILL.md` and `references/json_template.md` so they no longer claim that all fields are escaped until complete output encoding is enforced. ]]>