T09 · Insecure Skill Coding Practices
Warning
- Location
generate_metadata.py:116- Finding
Stored HTML Injection in Generated Metadata Reports
- Content
View full analysis
{metadata['title']} - 元数据{metadata['title']}
{'' + metadata['subtitle'] + '
' if metadata['subtitle'] else ''}作者: {metadata['author']}
语言: {metadata['language']}
出版日期: {metadata['publication_date']}
{'简介:
' + metadata['description'] + '
' if metadata['description'] else ''} {'关键词: ' + ', '.join(metadata['keywords']) + '
' if metadata['keywords'] else ''} ''' with open(output_path, 'w', encoding='utf-8') as f: f.write(html_content) ``` ### Technical Analysis The HTML output mode directly interpolates metadata fields into an HTML document without HTML escaping or sanitization. The affected values originate from command-line arguments, including the title, subtitle, author, language, publication date, description, and keywords. An attacker-controlled value containing HTML elements, event-handler attributes, or script-capable markup is written unchanged to the generated report. This is a stored HTML injection vulnerability. Its exploitability depends on how the report is subsequently opened and on the browser's treatment of active content in local files. ### Attack Path 1. An attacker supplies crafted metadata or persuades a user to run the tool with a malicious argument, such as an HTML payload in `--description`, `--title`, or `--author`. 2. The user requests HTML output through `--format html`. 3. `save_metadata()` concatenates the malicious value directly into `html_content`. 4. The generated fil ...[truncated 960 chars]- Remediation
View remediation