T09 · Insecure Skill Coding Practices
Error
- Location
template-dashboard/public/app.js:114- Finding
Stored Cross-Site Scripting Through Unsanitized Fulcra Record Values
- Content
View full analysis
${label}`; } } return textStr; } // Fallback for primitive values return d.value; } ``` The returned value is rendered through an HTML interpretation sink: ```html ``` ### Technical Analysis Timeline records are read from JSONL files and passed to `formatValue()`. Both `d.value` and the metadata-derived `label` can originate from downloaded Fulcra records. The function concatenates these values into an HTML string without escaping or sanitization. The dashboard then uses Alpine.js `x-html`, which assigns interpreted HTML rather than text. Consequently, a malicious record value such as an element with an event handler can introduce executable browser content. The fallback path is also vulnerable because it returns `d.value` directly to the same HTML sink. This is a stored XSS condition because ...[truncated 1485 chars]- Remediation
View remediation
``` 2. Do not use HTML entities or tags in `formatValue()`. Return plain text instead: ```javascript formatValue(d) { if (d.value === undefined || d.value === null) return ''; if ( d.metadata?.measurement_spec?.measurement_type === 'scale' ) { const maxVal = d.metadata.measurement_spec.scale?.max_allowed || 5; let result = `${String(d.value)}/${String(maxVal)}`; const mapping = d.metadata?.spec?.scale?.label_mapping?.string?.mapping; const label = mapping?.[String(d.value)]; if (label) { result += ` — ${String(label)}`; } return result; } return String(d.value); } ``` 3. If emphasized formatting is required, render the value and label in separate elements, each using `x-text`, instead of assembling HTML. 4. If arbitrary HTML is an unavoidable product requirement, sanitize it with a pinned, audited sanitizer and a strict element-and-attribute allowlist before passing it to `x-html`. 5. Add a restrictive Content Security Policy as defense in depth. Avoid permitting inline scripts or event handlers. 6. Add tests using payloads containing elements, event handlers, malformed tags, SVG content, and encoded markup to verify that all record fields are rendered only as text. ]]>