T09 · Insecure Skill Coding Practices
Error
- Location
assets/app.js:168- Finding
DOM-Based Cross-Site Scripting Through Unescaped Staff Input
- Content
View full analysis
...${this.renderStep()}... `; document.getElementById('app').innerHTML = html; }, renderStaffStep() { return ``; }, ``` ### Technical Analysis The application places `this.staffInput`, which contains user-controlled staff data, directly inside an HTML template. The completed template is then parsed using the `innerHTML` sink. No HTML escaping or sanitization is applied. An attacker can close the `textarea` element and inject active HTML containing an event handler or another executable browser construct. Because the payload is parsed as markup rather than assigned as a text value, it can execute in the security context of the application's origin. For example, a malicious staff entry can use a structure equivalent to: ```html👥 添加工作人员
请输入工作人员姓名或编号，每行一个
${this.staffInput}💡 提示：可以用编号+姓名，如 "001 张护士"``` The vulnerability can be triggered when the application renders the staff-entry step after the malicious value has been saved into `App.staffInput`. ### Attack Path 1. An attacker provides or persuades a user to paste a malicious staff entry into the staff input field. 2. The user advances to the next step, causing the application to save the field value in `App.staffInput`. 3. The user returns to the staff-entry step, or another application action calls `App.render()`. 4. `renderStaffStep()` embeds the malicious value into ...[truncated 796 chars]
- Remediation
View remediation
`, `"`, and `'`. 4. Prefer a templating framework that escapes interpolated values by default. 5. Remove inline event handlers and register handlers with `addEventListener`. 6. Add a restrictive Content Security Policy as defense in depth, for example by disallowing inline scripts and event handlers. A CSP must not be treated as a replacement for output encoding. 7. Add automated security tests using values that contain closing tags, event handlers, quotes, and other HTML metacharacters. ]]>