T09 · Insecure Skill Coding Practices
Warning
- Location
example/demo-apple-hig.html:1797- Finding
DOM-based cross-site scripting through an uploaded filename in the Apple HIG demo
- Content
View full analysis
${f.name}${size}×`; list.appendChild(item); } event.target.value = ''; } ``` ### Technical Analysis `File.name` is attacker-influenced data. The application interpolates it directly into an HTML template and assigns the resulting string to `innerHTML`. The browser consequently parses the filename as markup rather than displaying it exclusively as text. A filename containing an HTML element with an event handler, such as: ```text.txt ``` can create an executable element when selected in a browser or operating-system environment that permits such filename characters. The `onerror` handler runs immediately after the broken image is parsed. The file's contents do not need to be uploaded or read. Merely selecting a file with a malicious name is sufficient to reach the vulnerable sink. ### Attack Path 1. An attacker creates or distributes a file whose filename contains an HTML injection payload. 2. The victim opens the Apple HIG demonstration page. 3. The victim selects the attacker-supplied file through the upload component. 4. `handleUpload()` obtains the malicious name from `f.name`. 5. The filename is interpolated into a templa ...[truncated 1011 chars]
- Remediation
View remediation
item.remove()); item.append(name, fileSize, removeButton); list.appendChild(item); } event.target.value = ''; } ``` Additional hardening should include: - Avoid inline event handlers so a strict Content Security Policy can be applied. - Configure CSP without `unsafe-inline`, using nonces or external scripts as appropriate. - If HTML rendering is genuinely required elsewhere, use a maintained allowlist-based sanitizer; HTML escaping alone is preferable when only text is expected. - Add a regression test using filenames containing HTML metacharacters and verify that they are displayed literally without creating DOM elements. ]]>