T08 · Insecure Dependencies
Warning
- Location
quotation-template.html:7- Finding
Third-Party PDF Libraries Loaded Without Subresource Integrity Verification
- Content
View full analysis
``` `SKILL.md:175-176`: ```html ``` ### Technical Analysis The quotation template loads `html2canvas` and `jsPDF` directly from a third-party CDN. Although explicit library versions are used, the script elements do not include Subresource Integrity (`integrity`) hashes or `crossorigin="anonymous"`. Consequently, the browser trusts and executes whichever JavaScript is returned by the CDN URLs. If the CDN account, hosted artifact, DNS resolution, certificate trust path, or another part of the delivery infrastructure is compromised, a modified dependency can execute in the quotation document's browser context. The same pattern is explicitly required by `SKILL.md`, meaning newly generated quotation documents are also likely to inherit this supply-chain exposure. No evidence indicates that the currently referenced libraries are malicious; the risk arises from executing remotely delivered code without independent integrity verification. ### Attack Path 1. An attacker compromises the CDN artifact or another component capable of changing the JavaScript returned by one of the referenced URLs. 2. A user opens `quotation-template.html` or a generated quotation containing the prescribed script elements. 3. The browser downloads the modified dependency and executes it because no SRI ...[truncated 1194 chars]- Remediation
View remediation
``` The placeholder hashes must be replaced with independently verified hashes for the exact referenced artifacts; incorrect or invented hashes must not be used. 3. **Apply a restrictive Content Security Policy** - Restrict `script-src` to the minimum trusted sources. - Disallow unneeded framing, plugins, and connections. - Migrate the inline `onclick` handler and inline script to a local script file or use CSP nonces/hashes so that `unsafe-inline` is unnecessary. 4. **Update the generation instructions** - Modify `SKILL.md:175-176` so every newly generated quotation uses local audited dependencies or verified SRI attributes. - Ensure generated files do not silently revert to unverified CDN imports. 5. **Control dependency updates** - Maintain an approved dependency inventory containing versions, source URLs, checksums, and review dates. - Test PDF export after each dependency update and review release notes for security advisories. ]]>