T09 · Insecure Skill Coding Practices
Warning
- Location
static/index.html:253- Finding
DOM-based cross-site scripting through unsanitized transcript rendering
- Content
View full analysis
${role === "user" ? "You" : "Agent"}:${text}`; el.appendChild(line); el.scrollTop = el.scrollHeight; } ``` ### Technical Analysis The `text` value is concatenated directly into `innerHTML`. It originates from WebSocket transcript messages containing either speech-to-text output or the OpenClaw gateway's generated response. Neither the server nor the browser sanitizes it before HTML parsing. An HTML payload containing an executable event handler, such as an image with an `onerror` attribute, will therefore be interpreted as markup instead of displayed as text. The system prompt's request that the model avoid formatting is not a security boundary and does not prevent a model, external tool result, or manipulated response from returning HTML. The `role` field is also interpolated into an HTML attribute. Although the current server supplies fixed roles, the client should not assume WebSocket message contents are intrinsically safe. ### Attack Path 1. A user or malicious data source causes the OpenClaw agent to return attacker-controlled HTML, for example by requesting that it repeat a crafted string exactly. 2. The server forwards the response in a transcript WebSocket message: `{"type":"transcript","role":"assistant","text":""}`. 3. `addTranscript()` inserts the value through `innerHTML`. 4. The browser parses the injected element and executes its event handler in the voice assistant's origin. 5. The injected JavaScript can read displayed conversation content, alter the interface, make same-origin req ...[truncated 741 chars]
- Remediation
View remediation