render_report: finding text with an unclosed '<!--' and '<script' breaks the HTML report (data island swallows the app script)

Abierto Apto para principiantes
  • ¿Algo no está bien?
#157 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
76/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
html, python
Área
backend, testing-qa

Línea de trabajo

Start in skills/bmad-workflow-builder/scripts/render_report.py and trace inject() where findings JSON is placed in the report shell. Check the existing tests for report rendering and add a regression case with <!--<script in a finding. Done means the generated HTML has separate data and app script elements and the data island parses as JSON.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Describe the bug

render_report.py inject() embeds the findings JSON in <script id="report-data" type="application/json"> and escapes only </ (as <\/). The HTML parser also treats <!-- and <script specially inside script data. A JSON string containing <!-- followed by <script, with no --> after it, switches the tokenizer into the script data double-escaped state. The island's own </script> then no longer ends the element.

The data island swallows everything up to the next </script>, which is the report app's own script. The page ends up with one script element instead of two, the island is no longer valid JSON, and the report renders blank or broken.

Findings quote the files under analysis, so this triggers whenever a finding's evidence, title or recommendation quotes an HTML template or asset with an open comment before a script tag. That's realistic when analyzing skills that ship HTML, including this repo's own report-shell.html.

Steps to reproduce

cd skills/bmad-workflow-builder
python3 -c 'import json;print(json.dumps({"subject":"tpl","grade":"fair","findings":[{"id":"F1","lens":"structure","severity":"medium","title":"Unclosed comment","evidence":"line 40 opens <!-- before <script src=x> and never closes it"}]}))' > y.json
python3 scripts/render_report.py y.json --shell assets/report-shell.html -o y.html
pip install html5lib
python3 - <<'EOF'
import html5lib, json
d = html5lib.parse(open('y.html').read(), namespaceHTMLElements=False)
s = d.findall('.//script'); print(len(s), [x.get('id') for x in s])     # 1 ['report-data']  (expected 2)
isl = s[0].text; print(len(isl), 'function esc' in isl)                   # 20084 True  -> app code swallowed
json.loads(isl)                                                            # JSONDecodeError
EOF

Opening y.html in a browser shows the same broken page.

Expected behavior

Escape every < in the embedded JSON as \u003c (and optionally > as \u003e and & as \u0026). The result is still identical for JSON.parse, and no HTML tokenizer state can be triggered from the data. Add a regression test with <!--<script> in a finding.

Environment

  • Model(s) used: n/a (deterministic script)
  • Agentic IDE used: n/a (scripts run directly)
  • BMad version: bmad-builder main @ d4a921c (v2.2.2 + #118)
  • Project language: Python 3.13, Linux
Lenguaje dominante
Python
Estrellas
220
Forks
54
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de bmad-code-org/bmad-builder

Todos los issues de bmad-code-org/bmad-builder

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.