T09 · Insecure Skill Coding Practices
Warning
- Location
src/report-generator.js:576- Finding
Unescaped Report Data Allows HTML and Script Injection
- Content
View full analysis
${report.title} body { font-family: Arial, sans-serif; max-width: 1200px; margin: 0 auto; padding: 20px; } h1 { color: #333; } h2 { color: #666; border-bottom: 1px solid #ddd; padding-bottom: 10px; } table { border-collapse: collapse; width: 100%; margin: 20px 0; } th, td { border: 1px solid #ddd; padding: 8px; text-align: left; } th { background-color: #f5f5f5; } .passed { color: green; } .failed { color: red; } .warning { color: orange; } ${md.replace(/\n\n/g, '').replace(/\n/g, '
').replace(/^# (.*)$/m, '$1
').replace(/^## (.*)$/m, '$1
').replace(/^### (.*)$/m, '$1
')} `; } ``` ### Technical Analysis The HTML generator directly interpolates `report.title` into the `` element and inserts Markdown-derived content into the document body without HTML escaping or sanitization. The Markdown conversion consists only of regular-expression replacements and does not neutralize raw HTML, event-handler attributes, or other active browser content. The public report-generation methods accept caller-provided titles through their `options` parameters. Report-derived fields, including metric and category names, can also be incorporated into Markdown before reaching `toHTML()`. Consequently, an attacker who controls report options or evaluation data can place arbitrary markup into the generated HTML. For example, a malicious title could contain: ```html``` Likewise, attacker-controlled me ...[truncated 1814 chars]
- Remediation
View remediation
`, `"`, and `'` before placing untrusted text into HTML. - Encode the title separately for its `` context. - Encode all metric names, category names, recommendation text, and other report-derived values before rendering them. 2. **Use a maintained Markdown renderer** - Replace the regular-expression-based Markdown conversion with a maintained Markdown library. - Configure the renderer to reject, escape, or disable raw HTML. 3. **Sanitize the final document** - If limited HTML must be supported, process generated content with a maintained HTML sanitizer. - Use a restrictive allowlist of required elements and attributes. - Reject event-handler attributes, executable URLs, scripts, embedded frames, and other active content. 4. **Separate templates from data** - Use a template engine that enables auto-escaping by default. - Avoid marking report-derived values as trusted or raw HTML. 5. **Add defense-in-depth controls** - When reports are served over HTTP, apply a restrictive Content Security Policy that disallows inline scripts and untrusted resource origins. - Prefer serving generated reports from an isolated origin without access to authenticated application data. 6. **Add security regression tests** - Test titles, metric names, category names, and recommendation fields with payloads such as: ```html <img src=x onerror=alert(1)> ``` - Assert that the output contains encoded text rather than executable markup. - Test injection into both the document title and body. ]]>