T09 · Insecure Skill Coding Practices
Error
- Location
scripts/scaffold-app.js:151- Finding
Stored HTML and Script Injection Through the Generated Application Title
- Content
View full analysis
${title} ``` The title originates from an unrestricted command-line argument: ```js const title = args.title || "Web App"; ... const meta = { userName, token, title, goal, designSummary, ``` ### Technical Analysis `init-app.js` accepts an arbitrary `--title` value and stores it in application metadata without HTML validation or output encoding. `scaffold-app.js` subsequently interpolates that value directly into the generated `client/index.html`. An attacker-controlled title can close the existing `` element and inject additional markup, including a script element or another executable browser construct. For example, a title structurally equivalent to: ```html ``` would be embedded into the generated HTML document. Because the generated application is intended to be exposed through a public URL, the injected code would execute in the application origin when another user opens the page. This is a stored injection issue: the malicious input is persisted in `APP-META.json`, used during scaffolding, and delivered to every visitor of the generated frontend. ### Attack Path 1. An attacker influences the application title supplied to `init-app.js`, such as through a user request that becomes the `--title` argument. 2. `init-app.js` accepts and stores the title without escaping or markup validation. 3. `scaffold-app.js` reads the stored metadata and inserts the title into `client/index.html`. 4. The generated appl ...[truncated 970 chars]- Remediation
View remediation
`, `"`, and `'`. - Prefer generating a static safe title and setting the user-provided title through a text-only API such as `document.title`, with the value serialized safely by `JSON.stringify`. - Validate title length and reject control characters, null bytes, and markup when markup is not a legitimate title feature. - Apply contextual output encoding to every other metadata field used in generated HTML, Markdown, JavaScript, or configuration files. - Add automated tests using payloads that attempt to break out of the `` element. - Consider a restrictive Content Security Policy as defense in depth, while retaining output encoding as the primary fix. ]]>