T03 · Remote Payload Retrieval and Execution
Error
- Location
templates/base.html:1- Finding
Untrusted Remote JavaScript Executes Within the Sensitive Local Application Origin
- Content
View full analysis
{{ title or 'TaxClaw' }} ``` The application also does not set a Content Security Policy in its security middleware: ```python class SecurityHeadersMiddleware(BaseHTTPMiddleware): async def dispatch(self, request: Request, call_next): response = await call_next(request) response.headers["X-Content-Type-Options"] = "nosniff" response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin" response.headers["X-Frame-Options"] = "SAMEORIGIN" return response ``` ### Technical Analysis Every page derived from `base.html` downloads executable JavaScript from the third-party unpkg CDN. The resource has a nominal version in its URL, but it has no Subresource Integrity hash. The server also does not enforce a Content Security Policy capable of restricting scripts to locally reviewed resources. A script delivered by this CDN executes with the privileges of the TaxClaw web origin. It can inspect rendered tax data, read CSRF tokens embedded in forms or JavaScript, issue same-origin requests, enumerate document records, and retrieve sensitive previews or exports. The HTTP-only attribute on the CSRF cookie does not prevent this because the corresponding token is deliberately rendered into application pages. This is not evidence that the current HTMX package is malicious. The vulnerability is that the effective executable payload is retrieved remotely and can differ from the source reviewed in this audit. ### Attack Path 1. An attacker compromises the CDN, its package-publishing account ...[truncated 815 chars]- Remediation
View remediation