T09 · Insecure Skill Coding Practices
Error
- Location
cli.js:120- Finding
Arbitrary JavaScript Execution in Generated Chart HTML
- Content
View full analysis
\n' : ''; const base = embed ? loadLocal() : `${wcExtra}${getThemeCDN(theme)}`; if (slide) return `${title}${base}body{margin:0;background:#1a1a2e}.slide{width:960px;height:540px;display:flex;flex-direction:column;justify-content:center;align-items:center;background:linear-gradient(135deg,#1a1a2e,#16213e);page-break-after:always}.slide-title{color:#4facfe;font-size:28px;margin-bottom:20px}.slide-chart{width:900px;height:400px}`; return `${title}${base}body{margin:0;background:$ ...[truncated 3898 chars]${title}- Remediation
View remediation
... ``` 3. Before embedding JSON in HTML, replace `<` with `\u003c`. Consider also escaping `>`, `&`, U+2028, and U+2029 for defense in depth. 4. Use a well-tested HTML escaping function for values inserted into `` or normal HTML elements. Prefer assigning user-controlled text through `textContent`. 5. Validate the input-level `options` object against a strict schema. Allow only expected fields and types, such as bounded numeric dimensions, recognized theme names, booleans, and validated color values. 6. Avoid interpolating untrusted values into CSS. Apply dimensions and colors through validated DOM properties or generate them from normalized values. 7. Add a restrictive Content Security Policy. If inline scripts are necessary, use a nonce or hash rather than allowing unrestricted inline execution. 8. Add regression tests for payloads containing: - `</script><script>alert(1)</script>` - HTML element and attribute breakouts - CSS declaration and style-element breakouts - Unicode and encoded variants 9. Run screenshot and SVG rendering in an isolated browser context with unnecessary network access disabled when remote assets are not required. ]]>