T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_report.py:1853- Finding
Stored HTML and JavaScript Injection Through Unescaped Spreadsheet Data
- Content
View full analysis
0 else 0 current_data = current_dict.get(name, {'revenue': 0, 'profit': 0}) current_rev = current_data['revenue'] current_prof = current_data['profit'] current_gross_margin = ( current_prof / current_rev * 100 ) if current_rev > 0 else 0 html += f''' {i} {name} {fmt(rev)} {cumulative_gross_margin:.2f}% {fmt(current_rev)} {current_gross_margin:.2f}% ''' for i, (name, rev, prof) in enumerate(top_sales, 1): html += f''' {i} {name} {fmt(rev)} {fmt(prof)} ''' for i, (name, vol) in enumerate(top_sales_d_volume, 1): html += f''' {i} {name} {fmt_num(vol)} ''' for country, data in sorted( warehouse_data['by_country'].items(), key=lambda x: x[1]['inbound_containers'], reverse=True ): container_pct = ( data['inbound_containers'] / total_containers * 100 ) if total_con ...[truncated 4381 chars]- Remediation
View remediation
{i} {html_text(name)} {fmt(rev)} ''' ``` 2. Replace manual HTML concatenation with a template engine configured for automatic escaping, such as Jinja2 with autoescaping enabled. 3. Keep trusted markup separate from untrusted text. For action lists, escape each action before joining it with application-generated `
` elements: ```python actions = '
'.join( f'• {html_text(action)}' for action in rec['actions'] ) ``` 4. Use `json.dumps()` for all values embedded in JavaScript and never place raw spreadsheet content directly into script blocks. 5. Validate expected spreadsheet fields. Names, regions, and labels should have reasonable length limits and reject control characters, while escaping must remain the primary defense. 6. Correct all maintained copies: - `scripts/generate_report.py` - `scripts/generate_report_backup.py` - `scripts/generate_report_old.py` - `scripts/ai_analysis.py` 7. Add regression tests with values such as: ```text"> ``` The test should verify that these strings appear as escaped text and cannot create executable elements. 8. Add a restrictive Content Security Policy to generated reports as defense in depth. Avoid allowing inline scripts or inline event handlers where feasible. ]]>