T09 · Insecure Skill Coding Practices
Error
- Location
review-final-v4.py:137- Finding
Stored JavaScript Injection in the Generated Review Console
- Content
View full analysis
` element. In particular, an attacker-controlled string containing `` can terminate the surrounding script element even when the string is inside serialized JSON. The remainder of the value can then introduce an arbitrary HTML element or a new script block. The project name is independently inserted into a JavaScript single-quoted string and into HTML title and heading contexts. Characters such as single quotes, angle brackets, and script-closing sequences are not escaped for those contexts. Some manifest values are also later used to construct elements through `innerHTML`, increasing the number of potential injection sinks. ### Attack Path 1. An attacker supplies or modifies `storyboard-v2.js ...[truncated 1420 chars]- Remediation
View remediation
``` Populate that element using a safe HTML serializer, then load it with: ```javascript const MANIFEST = JSON.parse( document.getElementById("manifest-data").textContent ); ``` 3. If JSON must remain inline, escape at least `<`, `>`, `&`, U+2028, and U+2029 after serialization. Escaping `<` prevents `` from terminating the script element. 4. Serialize the project name as a JavaScript value rather than inserting it into a quoted string. 5. Use `textContent`, `createElement`, and `setAttribute` instead of constructing attacker-influenced markup with `innerHTML`. 6. Validate storyboard IDs, titles, paths, and other manifest fields against explicit schemas. 7. Add Content Security Policy restrictions that disallow inline scripts and limit outbound connections. 8. Add regression tests using payloads containing ``, quotes, event handlers, and HTML tags. ]]>