T09 · Insecure Skill Coding Practices
Error
- Location
scripts/visualize_decision.py:112- Finding
Persistent Script Injection in Generated Decision Reports
- Content
View full analysis
''+name+'' ).join(''); } ``` ```javascript angles.forEach((a, i) => { const x = cx + R * Math.cos(a), y = cy + R * Math.sin(a); html += ''; const lx = cx + (R + 24) * Math.cos(a), ly = cy + (R + 24) * Math.sin(a); html += ''+DATA.dimensions[i]+''; }); svg.innerHTML = html; ``` ```javascript function renderSliders() { document.getElementById('sliders').innerHTML = DATA.dimensions.map((dim, i) => ''+dim+''+weights[i]+'%' ).join(''); } ``` ```javascript function renderMatrix ...[truncated 3321 chars]- Remediation
View remediation
` block or another inert container. Before embedding serialized JSON into HTML, escape `<`, `>`, `&`, and Unicode line separators, including conversion of `<` to `\u003c`. 4. Escape the visible title with `html.escape(args.title, quote=True)` before placing it in an HTML text context. 5. Validate the input schema: - Require dimensions and weights to be arrays. - Require all labels to be strings with reasonable length limits. - Require weights and scores to be finite numeric values within documented ranges. - Require at least one dimension and one option. 6. Add a restrictive Content Security Policy that disallows inline and remote scripts. Move the page JavaScript into a separately generated static file or authorize it with a per-document nonce. 7. Add regression tests using labels containing closing script tags, HTML event handlers, SVG payloads, quotation marks, ampersands, and Unicode separator characters. 8. Treat existing generated reports as potentially unsafe and regenerate them after the encoding and DOM construction fixes are deployed. ]]>