T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/report_renderer.py:237- Finding
Unescaped Report Data Enables Stored HTML Injection and Unrestricted Resource References
- Content
View full analysis
{% if section.caption %}
{{ section.caption }}{% endif %} {% endif %} {% if section.analysis %}{{ section.analysis }}{% endif %} ... {% elif section.type == 'text' %}{{ section.content | safe }}``` ```python def render_html(config, output, theme="professional"): """Render an HTML report.""" env = jinja2.Environment( loader=jinja2.DictLoader({"report.html": HTML_TEMPLATE}), autoescape=False, ) env.filters["status_class"] = status_class env.filters["risk_class"] = risk_class env.filters["pct_class"] = pct_class template = env.get_template("report.html") html = template.render(config=config) output_path = Path(output) output_path.parent.mkdir(parents=True, exist_ok=True) output_path.write_text(html, encoding="utf-8") ``` ```python env = jinja2.Environment( loader=jinja2.DictLoader({"report.html": HTML_TEMPLATE}), autoescape=False, ) env.filters["status_class"] = status_class env.filters["risk_class"] = risk_class env.filters["pct_class"] = pct_class template = env.get_template("report.html") html = template.render(config=config) output_path = Path(output) output_path.parent.mkdir(parents=True, exist_ok=True) HTML(string=html).write_pdf(str(output_path)) ``` ### Technical Analysis The renderer treats data loaded from the report configuration as trusted markup. Jinja autoescaping is disabled globally for both HTML and PDF rendering, and the `text` section explicitly applies the `sa ...[truncated 2984 chars]- Remediation
View remediation