T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_report.py:36- Finding
Unescaped Prospect Data Enables HTML Injection and Unsafe Links
- Content
View full analysis
{p['name']}{p['position']}Location: {p.get('location', 'N/A')} | LinkedIn ProfileGap Analysis:
-
"""
for need in p.get('needs', []):
html += f"
- {need} " html += f"""
``` The same unsafe interpolation continues in the pitch field: ```python Pitch Idea: {p.get('pitch', 'N/A')} ``` ### Technical Analysis `generate_html()` parses caller-supplied JSON and directly interpolates the resulting values into HTML. The fields `name`, `position`, `location`, each item in `needs`, and `pitch` are inserted without HTML escaping. The `linkedin_url` value is inserted into an `href` attribute without attribute escaping, URI-scheme validation, or host validation. An attacker who controls any of these values can inject arbitrary HTML, including deceptive report content, images that issue external requests, or event-handler attributes. A crafted `linkedin_url` can also use an active URI scheme such as `javascript:`. Whether injected JavaScript executes depends on the browser or HTML-to-PDF renderer and its security configuration. The project workflow gathers data from external profiles and websites, so malicious external content could enter the report even when the person generating it did not intentionally provide hostile JSON. ### Attack Path 1. An att ...[truncated 1502 chars]- Remediation
View remediation