T09 · Insecure Skill Coding Practices
- Location
output_templates.py:16- Finding
Unescaped User-Controlled Content Enables HTML and Script Injection
- Content
View full analysis
\n') content = re.sub(r'\*\*(.+?)\*\*', r'\1', content) content = re.sub(r'\*(.+?)\*', r'\1', content) content = re.sub(r'`(.+?)`', r'
\1', content) # Handle headers content = re.sub(r'^### (.+)$', r'\1
', content, flags=re.MULTILINE) content = re.sub(r'^## (.+)$', r'\1
', content, flags=re.MULTILINE) content = re.sub(r'^# (.+)$', r'\1
', content, flags=re.MULTILINE) # Add image placeholders if requested if options.get('image_placeholders'): content = content.replace('[IMAGE]', '\n\n') tags_html = ' '.join(f'{html.escape(tag)}' for tag in tags) return f"""
By {html.escape(author)} {html.escape(date)}{content}
``` #### Email template (`output_templates.py:83-129`) ```python def email_template(content, metadata, options): """Email newslet ...[truncated 4320 chars]- Remediation
View remediation
\n') safe_content = re.sub(r'\*\*(.+?)\*\*', r'\1', safe_content) safe_content = re.sub(r'\*(.+?)\*', r'\1', safe_content) safe_content = re.sub(r'`(.+?)`', r'
\1', safe_content) ``` 3. If intentional raw HTML support is required, use a maintained HTML sanitizer with a strict allowlist. Permit only necessary elements and attributes, and reject: - `script`, `iframe`, `object`, `embed`, and unsafe SVG or MathML elements; - attributes beginning with `on`, such as `onclick` and `onerror`; - `javascript:`, unsafe `data:`, and other dangerous URL schemes; - inline styles or other attributes that are not explicitly required. 4. Treat downstream platform sanitization as defense in depth rather than the primary control. 5. Add automated security tests covering: - `