T08 · Insecure Dependencies
Warning
- Location
- assets/themes/am_template.scss:5
- Finding
- Unpinned Third-Party CSS and Font Resources Loaded During Rendering## Vulnerability Details **File Location**: `assets/themes/am_template.scss`, lines 5–6 **Vulnerability Type**: Insecure third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```scss @import 'https://cdn.bootcdn.net/ajax/libs/font-awesome/6.4.0/css/all.min.css'; @import url(https://fonts.bunny.net/css?family=charm:700); ``` The affected base theme is transitively loaded by the course theme: ```scss /* assets/themes/am_blue_course.scss, line 3 */ @import 'am_template'; ``` ### Technical Analysis The required `am_blue_course` theme imports `am_template.scss`, which retrieves CSS and font resources from BootCDN and Bunny Fonts when the rendering environment permits remote resource loading. Although the Font Awesome URL names version `6.4.0`, neither remote import is locally vendored or protected by an integrity check. The effective content therefore remains controlled by external infrastructure after the Skill package has been reviewed. A compromised CDN, DNS route, upstream asset, or remote account could return altered CSS or references to additional remote resources. The requests also expose network metadata—such as the renderer's IP address, request timing, and HTTP headers—to third parties. Rendering is consequently not fully offline, deterministic, or reproducible. This is a supply-chain exposure rather than evidence that the current remote resources are malicious. ### Attack Path 1. A user invokes the Skill to create a Marp presentation using the required `am_blue_course` theme. 2. `assets/themes/am_blue_course.scss:3` imports the local `am_template` theme. 3. The renderer processes the remote imports at `assets/themes/am_template.scss:5–6`. 4. The rendering environment connects to BootCDN and Bunny Fonts. 5. If either delivery path is compromised, an attacker can return modified CSS or references to attacker-controlled resources. 6. The renderer processes that attacker-controlled content within the capabilities and security boundari ...[truncated 771 chars]
- Remediation
- ## Remediation Suggestions 1. Download and audit the required Font Awesome stylesheet, font files, and Charm font assets. 2. Store those resources inside the project and reference them using local, project-relative paths. 3. Pin vendored resources to reviewed versions and record checksums in the release process. 4. Remove all runtime `http://` and `https://` imports from the SCSS themes. 5. Configure the Marp renderer or surrounding sandbox to deny outbound network access during compilation and rendering. 6. If remote resources are operationally unavoidable, restrict outbound access to an explicit allowlist, use immutable versioned resources, and verify downloaded artifacts before use. Because SCSS `@import` does not provide Subresource Integrity enforcement, local vendoring is preferred. 7. Add an automated repository check that rejects remote CSS imports and remote font or image references in active themes.