T09 · Insecure Skill Coding Practices
Error
- Location
scripts/report/report_generator.py:313- Finding
Stored HTML and JavaScript Injection in Generated Reports
- Content
View full analysis
str: """ Render the HTML report. @param data: Report data @return: HTML content """ # Attempt to load the template from a file if self.template_path.exists(): with open(self.template_path, 'r', encoding='utf-8') as f: template_content = f.read() template = Template(template_content) else: # Use the built-in template template = Template(self._get_default_template()) return template.render(**data) ``` Untrusted filenames and extracted document content are inserted into HTML contexts: ```html {% for file in file_list %} {{ loop.index }} {{ file.name }} {{ file.char_count }} {{ file.para_count }} {{ file.duplicate_count }} {% endfor %} ``` ```html {% for dup in duplicate_details %}{% if dup.source_heading %}{{ dup.source_heading }} → {% endif %} {{ dup.source_file }} 第{{ dup.source_index }}段{% if dup.target_heading %}{{ dup.target_heading }} → {% endif %} {{ dup.target_file }} 第{{ dup.target_index }}段text {{ dup.source.text }}- Remediation
View remediation
``` 6. Add regression tests using payloads containing `