T09 · Insecure Skill Coding Practices
Warning
- Location
references/custom-overlay.md:127- Finding
DOM-Based Cross-Site Scripting Through Unsanitized Overlay Properties
- Content
View full analysis
${this.properties.title}
${this.properties.desc}
`; ``` ### Technical Analysis The documented example interpolates `imgSrc`, `title`, and `desc` directly into an HTML string and assigns it to `innerHTML`. No contextual encoding, sanitization, or URL validation is performed. If an application follows this example and populates these properties from search results, APIs, databases, URL parameters, or other untrusted sources, an attacker can inject HTML attributes or elements. For example, a malicious value placed in `imgSrc` could terminate the `src` attribute and introduce an event handler. Malicious markup in `title` or `desc` would also be parsed as HTML rather than displayed as text. Although the values shown in the documentation are static, this pattern is unsafe when reused with dynamic data. ### Attack Path 1. An application implements the documented `createInfoCard` function. 2. The application assigns attacker-controlled content to `this.properties.imgSrc`, `title`, or `desc`. 3. The function interpolates the content into the template literal without validation. 4. The resulting string is assigned to `div.innerHTML`. 5. The browser parses the injected markup in the application's origin. 6. An injected event handler or other executable HTML context runs when the relevant event occurs. ### Impact Assessment Successful exploitation can execute JavaScript in the security context of the integrating web application. Depending on the application's architecture and browser protections, an attacker may: - Read or modify DOM-visible application data. - Perform authenticated actions using the victim's active session. - Access creden ...[truncated 405 chars]- Remediation
View remediation