render_report: finding text with an unclosed '<!--' and '<script' breaks the HTML report (data island swallows the app script)

Aperta Adatta ai principianti
  • Qualcosa non va?
#157 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
76/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
html, python
Ambito
backend, testing-qa

Direzione di ricerca

Start in skills/bmad-workflow-builder/scripts/render_report.py and trace inject() where findings JSON is placed in the report shell. Check the existing tests for report rendering and add a regression case with <!--<script in a finding. Done means the generated HTML has separate data and app script elements and the data island parses as JSON.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Describe the bug

render_report.py inject() embeds the findings JSON in <script id="report-data" type="application/json"> and escapes only </ (as <\/). The HTML parser also treats <!-- and <script specially inside script data. A JSON string containing <!-- followed by <script, with no --> after it, switches the tokenizer into the script data double-escaped state. The island's own </script> then no longer ends the element.

The data island swallows everything up to the next </script>, which is the report app's own script. The page ends up with one script element instead of two, the island is no longer valid JSON, and the report renders blank or broken.

Findings quote the files under analysis, so this triggers whenever a finding's evidence, title or recommendation quotes an HTML template or asset with an open comment before a script tag. That's realistic when analyzing skills that ship HTML, including this repo's own report-shell.html.

Steps to reproduce

cd skills/bmad-workflow-builder
python3 -c 'import json;print(json.dumps({"subject":"tpl","grade":"fair","findings":[{"id":"F1","lens":"structure","severity":"medium","title":"Unclosed comment","evidence":"line 40 opens <!-- before <script src=x> and never closes it"}]}))' > y.json
python3 scripts/render_report.py y.json --shell assets/report-shell.html -o y.html
pip install html5lib
python3 - <<'EOF'
import html5lib, json
d = html5lib.parse(open('y.html').read(), namespaceHTMLElements=False)
s = d.findall('.//script'); print(len(s), [x.get('id') for x in s])     # 1 ['report-data']  (expected 2)
isl = s[0].text; print(len(isl), 'function esc' in isl)                   # 20084 True  -> app code swallowed
json.loads(isl)                                                            # JSONDecodeError
EOF

Opening y.html in a browser shows the same broken page.

Expected behavior

Escape every < in the embedded JSON as \u003c (and optionally > as \u003e and & as \u0026). The result is still identical for JSON.parse, and no HTML tokenizer state can be triggered from the data. Add a regression test with <!--<script> in a finding.

Environment

  • Model(s) used: n/a (deterministic script)
  • Agentic IDE used: n/a (scripts run directly)
  • BMad version: bmad-builder main @ d4a921c (v2.2.2 + #118)
  • Project language: Python 3.13, Linux
Lingua principale
Python
Stelle
220
Fork
54
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di bmad-code-org/bmad-builder

Tutte le issue di bmad-code-org/bmad-builder

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.