fix(html): escape the compliance column

prowler/changelog.d/html-compliance-escape.security.md

@@ -0,0 +1 @@
+HTML report compliance column is now escaped, so framework names and requirement IDs containing markup are shown as text instead of being rendered by the browser

prowler/lib/outputs/html/html.py

@@ -116,7 +116,7 @@ class HTML(Output):
                             <td>{str(escape(finding.status_extended)).replace("_", "<wbr />_")}</td>
                             <td><p class="show-read-more">{HTML.process_markdown(str(escape(finding.metadata.Risk)))}</p></td>
                             <td><p class="show-read-more">{HTML.process_markdown(str(escape(finding.metadata.Remediation.Recommendation.Text)))}</p> <a class="read-more" href="{str(escape(_safe_url(finding.metadata.Remediation.Recommendation.Url)))}"><i class="fas fa-external-link-alt"></i></a></td>
-                            <td><p class="show-read-more">{parse_html_string(unroll_dict(finding.compliance, separator=": "))}</p></td>
+                            <td><p class="show-read-more">{parse_html_string(str(escape(unroll_dict(finding.compliance, separator=": "))))}</p></td>
                         </tr>
                         """)
         except Exception as error:

tests/lib/outputs/html/html_test.py

@@ -910,6 +910,23 @@ class TestHTML:
         assert "•key&<>'"<img" in output_data
         assert "=value&<>'"<img" in output_data
 
+    def test_transform_escapes_compliance(self):
+        xss_payload = '<img src=x onerror="window.PROWLER_COMPLIANCE_XSS=1">'
+        findings = [
+            generate_finding_output(
+                compliance={f"Framework{xss_payload}-1.0": [xss_payload, "1.1"]},
+            )
+        ]
+
+        output_data = HTML(findings).data[0]
+
+        assert xss_payload not in output_data
+        assert (
+            "&#x2022;Framework&lt;img src=x "
+            "onerror=&#34;window.PROWLER_COMPLIANCE_XSS=1&#34;&gt;-1.0: "
+            "&lt;img src=x onerror=&#34;window.PROWLER_COMPLIANCE_XSS=1&#34;&gt;, 1.1"
+        ) in output_data
+
     def test_transform_escapes_metadata_fields(self):
         finding = generate_finding_output()
         finding.metadata.Severity = MagicMock(value='<img data-field="severity" src=x>')