T09 · Insecure Skill Coding Practices
Error
- Location
assets/voice-chat-local/public/app.js:61- Finding
DOM-Based Cross-Site Scripting in Chat Message Rendering
- Content
View full analysis
${role === 'user' ? '你' : '宁姚'}${content}`; messagesNode.appendChild(item); item.scrollIntoView({ behavior: 'smooth', block: 'end' }); } ``` ### Technical Analysis The `content` parameter is inserted directly into `item.innerHTML` without HTML escaping or sanitization. The function is used to display both user-controlled messages and model-generated replies. Because model output can be influenced by prompts and may also originate from a configurable OpenAI-compatible endpoint, it must be treated as untrusted. If `content` contains active HTML such as an element with an event handler, the browser parses it as markup rather than displaying it as text. An attacker or compromised model endpoint could therefore return content such as: ```html``` The exact exfiltration request may be constrained by browser networking policy, but the injected script still executes with the local application's origin and can issue and read same-origin API requests. ### Attack Path 1. The victim opens the local voice-chat interface. 2. The attacker influences a model reply through prompt manipulation, a malicious compatible API endpoint, or compromised upstream output. 3. The response contains attacker-supplied HTML with an executable event handler. 4. `sendMessage()` passes the returned `dat ...[truncated 1080 chars]
- Remediation
View remediation