T09 · Insecure Skill Coding Practices
Error
- Location
token_report.py:251- Finding
Stored HTML and Script Injection in Generated Dashboard
- Content
View full analysis
{provider} ${breakdown.total_cost:.2f} ({percentage:.1f}%)""" ``` Model names are also inserted directly: ```python bars_html += f"""""" ``` Dates derived from imported timestamps are placed inside an HTML attribute: ```python bars_html += f'' ``` Waste alerts embed the unescaped model name: ```python alerts_html += f"""{model} ${breakdown.total_cost:.2f} ({breakdown.request_count} requests)⚠️ {case['model']}""" ``` The affected values originate from imported, potentially attacker-controlled CSV or JSON records. Relevant source assignments include: ```python timestamp = row.get('Timestamp') or row.get('timestamp') or row.get('Date') model = row.get('Model') or row.get('model') ``` and: ```python timestamp = item.get('timestamp') or item.get('created_at') model = item.get('model') ``` No HTML escaping or contextual output encoding is applied before these ...[truncated 2968 chars]
Cost: ${case['total_cost']:.2f} across {case['request_count']} requests
{case['suggestion']}- Remediation
View remediation
{safe_provider} ``` ```python {safe_model} ``` ```python bars_html += ( f'' ) ``` 4. Validate imported records before report generation: - Require provider and model fields to be strings. - Set reasonable maximum lengths. - Reject control characters. - Parse timestamps into a strict accepted format and regenerate their display representation from the parsed date. - Reject non-finite or negative numeric values where they are not meaningful. 5. Prefer a template engine with automatic HTML escaping if external dependencies become acceptable. Keep auto-escaping enabled and avoid marking imported content as safe. 6. Add a restrictive Content Security Policy to provide defense in depth. For example: ```html ``` Output encoding remains necessary because a policy does not prevent all HTML-based report spoofing. 7. Add regression tests using payloads in every imported text field, including: - `` - `` - `" onmouseover="aler ...[truncated 218 chars]