T09 · Insecure Skill Coding Practices
Error
- Location
scripts/perstate-view.sh:318- Finding
Stored Cross-Site Scripting in Knowledge Graph Viewer
- Content
View full analysis
0) { metaRows.push('' + listKey + '' + listItems.join(', ') + ''); inList = false; listItems = []; } var m = line.match(/^(\w+):\s*(.*)$/); if (m) { var key = m[1], val = m[2].trim(); if (val === '' || val === 'null' || val === '[]') continue; if (val === '') { inList = true; listKey = key; listItems = []; } else { metaRows.push('' + key + '' + val + ''); } } var bodyMarkdown = bodyHtml ? marked.parse(bodyHtml) : ''; return metaHtml + (bodyMarkdown ? '' + bodyMarkdown + '' : ''); ``` The resulting HTML is inserted into the document at lines 348–349 and 359–360: ```javascript var content = contentMap[nodeId] || ''; previewContent.innerHTML = renderPreview(content); ``` ### Technical Analysis Entity and relation content is loaded from the synchronized knowledge repository. The viewer passes Markdown through `marked.parse()` and assigns the result to `innerHTML` without HTML sanitization. Markdown parsers generally preserve embedded HTML unless explicitly configured or followed by a sanitizer. Frontmatter keys, values, and list elements are also concatenated directly into HTML table markup. JSON escaping performed earlier protects JavaScript string syntax but does not provide HTML-context sanitization after those strings are parsed and rendered. Consequently, knowledge content containing HTML elements with event handlers, dangerous links, or similar active content can execute script in the generated graph page. This is especially relevant when the configured Git repository or branch is shared with other contributors. ...[truncated 1373 chars]- Remediation
View remediation