T09 · Insecure Skill Coding Practices
Error
- Location
assets/app-template/assets/js/app.js:779- Finding
Stored DOM-Based Cross-Site Scripting Through Unescaped Question Option Keys
- Content
View full analysis
' + opts.map(function (o) { var cls = 'opt'; if (locked) { cls += ' locked'; if (right.indexOf(o.key) >= 0) cls += ' ok'; else if (sel.indexOf(o.key) >= 0) cls += ' bad'; } else if (sel.indexOf(o.key) >= 0) cls += ' sel'; return '' + o.key + '' + '' + esc(o.text) + ''; }).join('') + ''; } ``` The same unsafe construction exists in the batch-mode renderer: ```javascript function batchOptionsHtml(q, opts, sel, idx) { return '' + opts.map(function (o) { ...[truncated 2764 chars]- Remediation
View remediation
' + esc(o.key) + '' + esc(o.text) + ''; ``` Apply the same correction to `batchOptionsHtml()`. 3. Prefer DOM construction over string-based HTML generation. Set untrusted values through `textContent` and attributes through `setAttribute()`. 4. Audit every `innerHTML` and `insertAdjacentHTML` call for data originating from question banks or browser storage. 5. Add regression tests using option keys containing quotes, angle brackets, event handlers, and entity-encoded payloads. Validation should reject them, and rendering should never create executable elements. ]]>