T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/chart.sh:559- Finding
Stored markup and script injection in generated SVG and HTML charts
- Content
View full analysis
{}'.format(svg_w/2, title) ) for i, (label, val) in enumerate(pairs): # ... parts.append( '{}'.format( x + bar_w/2, margin_top + chart_h + 20, label ) ) with open(fname, 'w', encoding='utf-8') as f: f.write('\n'.join(parts)) ``` ```python # HTML bar output for i, (label, val) in enumerate(pairs): # ... svg_bars.append( ' ' '{label}\n' ' \n' ' {val}'.format( ty=y + bar_height // 2 + 5, label=label, ry=y, w=w, h=bar_height, color=color, tx=w + 108, val=val_str ) ) html = """ {title}{title}
- Remediation
View remediation
{}'.format(escape(label, quote=True)) ``` 3. Prefer a proper XML or HTML construction library, such as `xml.etree.ElementTree`, instead of manually concatenating markup. A serializer will encode text-node content safely. 4. Keep numeric parsing strict and reject non-finite values such as `NaN` and infinity where they can produce invalid geometry. 5. Consider applying a restrictive Content Security Policy to generated HTML as defense in depth: ```html ``` 6. Add regression tests using titles and labels containing `<`, `>`, `&`, single and double quotes, closing tags, SVG script elements, and event-handler attributes. Verify that these characters are encoded and remain visible only as text. ]]>