T09 · Insecure Skill Coding Practices
Warning
- Location
skill/output-templates/html-template.md:333- Finding
Stored Cross-Site Scripting Through Unescaped Admissions Data
- Content
View full analysis
``).join(''); } ``` ### Techni ...[truncated 3501 chars]${p.name}
${p.uni} · ${p.faculty}Degree ${p.degree}Mode ${p.mode.split(/[&,]/).map(m => ''+m.trim()+'' ).join(' ')}Duration${p.duration}Tuition${p.tuitionTotal}Deadline${p.deadlineMain}IELTS${p.ielts}TOEFL${p.toefl}- Remediation
View remediation
`, `&`, U+2028, and U+2029. - Prefer loading serialized data from a non-executable `application/json` element and parsing its `textContent`. 4. **Add defense-in-depth browser controls** - Add a restrictive Content Security Policy that disallows inline event handlers and unexpected network destinations. - Avoid inline scripts where practical and use a nonce or hash if scripts must remain inline. - Restrict navigation and resource loading to expected HTTPS destinations. 5. **Add regression tests** - Test text fields with payloads such as ``, closing tags, quotes, and encoded markup. - Test URL fields with `javascript:`, `data:`, malformed URLs, credential-bearing URLs, and deceptive suffixes. - Verify that payloads are displayed only as literal text and never become executable DOM elements. - Apply the corrected implementation to both the reusable template and regenerated HTML artifacts. ]]>