T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/xborder-ecom-check.py:310- Finding
Unescaped Cloud-Controlled Data in Generated HTML Reports
- Content
View full analysis
= 80 else "#ff9800" if score >= 60 else "#f44336" rows = "" current_cat = "" for r in items: if r.get("category_name") != current_cat: current_cat = r.get("category_name", "") rows += f'{current_cat}\n' icon = "✅" if r.get("passed") else "❌" cls = "pass" if r.get("passed") else "fail" rec = r.get("recommendation") or "Keep it up" rows += f"""{icon}{r.get('name')}{r.get('legal_ref') or ''}{cls.upper()}{rec}\n""" ``` ### Technical Analysis The HTML renderer directly interpolates `category_name`, `name`, `legal_ref`, and `recommendation` into HTML without applying context-appropriate output encoding. These fields can originate from responses supplied by the remote rules or evaluation service. Consequently, the cloud service crosses a trust boundary before its content is written into a local HTML report. A compromised service, malicious backend response, or corrupted rule entry could insert active markup such as an element with an event handler. Because the generated document is intended to be opened in a browser, injected markup may be interpreted rather than displayed as text. The exact capabilities of injected script depend on browser restrictions for local files, but the payload could alter the report, display deceptive content, initiate external requests, or execute JavaScript in the report's document context. ### Attack Path 1. An attacker compromises the configured cloud service or gains the ability to modify a rule or evaluation respo ...[truncated 1490 chars]- Remediation
View remediation
``` This provides defense in depth but must not be treated as a substitute for output encoding. 6. Add regression tests using payloads such as: ```text``` Verify that the generated file contains escaped text such as `<script>` and does not create executable elements. ]]>