T09 · Insecure Skill Coding Practices
Error
- Location
scripts/viz/viz.js:184- Finding
Stored Cross-Site Scripting in Generated Knowledge Graph
- Content
View full analysis
window.BUNDLE_NAME = __BUNDLE_NAME__; window.BUNDLE = __BUNDLE_DATA__; ``` ```javascript const body = bundle.bodies[conceptId] || ""; const html = marked.parse(body, { breaks: false, gfm: true }); const bodyEl = document.getElementById("detail-body"); bodyEl.innerHTML = html; ``` ### Technical Analysis Wiki page bodies originate from local files, IMA notes, or Evernote notes and are treated as trusted HTML after Markdown conversion. `marked.parse()` does not provide HTML sanitization, and the resulting content is assigned directly to `innerHTML`. Consequently, HTML elements and event-handler attributes embedded in a wiki page can become executable DOM content. There is a second injection point in the graph generator. `json.dumps()` safely creates JSON syntax but does not escape an HTML closing script sequence such as ``. Because the serialized graph is inserted directly inside an executable `- Remediation
View remediation
... ``` Then parse its text content: ```javascript const bundle = JSON.parse( document.getElementById("bundle-data").textContent ); ``` 4. During JSON serialization, escape at least `<`, `>`, `&`, U+2028, and U+2029. Escaping `<` prevents `` from terminating the element. 5. Add a restrictive Content Security Policy that disallows inline scripts and limits network destinations. 6. Add regression tests containing script tags, SVG event handlers, image error handlers, and literal `` sequences. ]]>