T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_html_report.py:87- Finding
Stored HTML and SVG Injection in Generated Payroll Reports
- Content
View full analysis
{short_name}' ) ``` It also inserts audit item names, summaries, details, priorities, and count values directly into HTML: ```python def generate_audit_cards(audit_results): """Generate audit-item status cards.""" cards = [] for r in audit_results: status = r.get("status", "unknown") status_icon = {"pass": "✅", "warning": "⚠️", "error": "❌", "unknown": "❓"}.get(status, "❓") priority = r.get("priority", "P1") priority_class = f"priority-{priority.lower().replace('（', '').replace('）', '')}" details_html = "" if r.get("details"): details_html = "- " + "".join(f"
- {d} " for d in r["details"]) + "
''' cards.append(card) return '\n'.join(cards) ``` Material names, risk descriptions, and processing-log values are similarly interpolated w ...[truncated 4592 chars]{status_icon} {r.get("audit_item", "Unknown")} {status.upper()}{r.get("summary", "")}
{details_html} {f"Statistics: {r['counts']['total_unique']} total, {r['counts']['in_both']} matched
" if "counts" in r else ""}- Remediation
View remediation
` - `` - SVG closing tags - Quotes and malformed attributes - `javascript:` URLs - Markdown pipes and embedded HTML 8. Consider applying a restrictive Content Security Policy to generated reports as defense in depth, while not treating CSP as a substitute for output encoding. ]]>