<< Back to security report
Repositoryaj-geddes/useful-ai-prompts →
Commit3f5182c →
VerdictFAIL
Score0
DateSep 2, 2026
| Severity | Rule | Message | File:Line |
|---|---|---|---|
| MEDIUM | generic.html-templates.security.var-in-script-tag.var-in-script-tag | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using the 'json_script' template tag and retrieving the data in your script by using the element ID (e.g., `document.getElementById`). | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/analytics.html:219 → |
| MEDIUM | generic.html-templates.security.var-in-script-tag.var-in-script-tag | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using the 'json_script' template tag and retrieving the data in your script by using the element ID (e.g., `document.getElementById`). | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/analytics.html:490 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/community-integration.html:122 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/content-marketing.html:73 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/footer.html:7 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/footer.html:69 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/footer.html:70 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/footer.html:71 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/footer.html:72 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/footer.html:82 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/footer.html:125 → |
| MEDIUM | generic.html-templates.security.var-in-script-tag.var-in-script-tag | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using the 'json_script' template tag and retrieving the data in your script by using the element ID (e.g., `document.getElementById`). | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/google-analytics.html:13 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/header.html:8 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/header.html:63 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/header.html:66 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/header.html:69 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/header.html:74 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/header.html:100 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/header.html:218 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/header.html:221 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/header.html:224 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/header.html:227 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/header.html:231 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/social-sharing.html:136 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/social-sharing.html:153 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/social-sharing.html:168 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/social-sharing.html:185 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/social-sharing.html:194 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/social-sharing.html:203 → |
| MEDIUM | generic.html-templates.security.var-in-script-tag.var-in-script-tag | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using the 'json_script' template tag and retrieving the data in your script by using the element ID (e.g., `document.getElementById`). | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/social-sharing.html:246 → |
| MEDIUM | generic.html-templates.security.var-in-script-tag.var-in-script-tag | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using the 'json_script' template tag and retrieving the data in your script by using the element ID (e.g., `document.getElementById`). | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/social-sharing.html:247 → |
| MEDIUM | generic.html-templates.security.var-in-script-tag.var-in-script-tag | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using the 'json_script' template tag and retrieving the data in your script by using the element ID (e.g., `document.getElementById`). | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/social-sharing.html:248 → |
| MEDIUM | generic.html-templates.security.var-in-script-tag.var-in-script-tag | Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI. For Django, you may also consider using the 'json_script' template tag and retrieving the data in your script by using the element ID (e.g., `document.getElementById`). | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/social-sharing.html:249 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_includes/viral-features.html:130 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/category.html:15 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/category.html:17 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/category.html:91 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/category.html:129 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/hook.html:35 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/hook.html:37 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/hook.html:177 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/hook.html:195 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/prompt.html:10 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/prompt.html:13 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/prompt.html:37 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/prompt.html:201 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/skill.html:35 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/skill.html:37 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/skill.html:118 → |
| MEDIUM | generic.html-templates.security.var-in-href.var-in-href | Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href="/{{link}}"`). You may also consider setting the Content Security Policy (CSP) header. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_layouts/skill.html:130 → |
| HIGH | python.lang.security.use-defused-xml.use-defused-xml | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. | aj-geddes/useful-ai-prompts/log-analysis-8cac96d1/docs/_scripts/seo-validator.py:10 → |