T09 · Insecure Skill Coding Practices
Error
- Location
scripts/business_blueprint/templates/html-viewer.html:191- Finding
Stored JavaScript Injection Through Blueprint Title
- Content
View full analysis
const a = document.createElement('a'); a.href = url; a.download = '{{TITLE}}.svg'; ``` The `_esc()` function only applies XML escaping: ```python def _esc(s: str) -> str: return escape(str(s)) ``` ### Technical Analysis The blueprint title is attacker-controlled content. Although `_esc()` encodes XML-sensitive characters such as `<`, `>`, and `&`, it does not escape apostrophes or other characters required for safe insertion into a single-quoted JavaScript string. Consequently, a title such as: ```text ';alert(document.domain);// ``` produces JavaScript equivalent to: ```javascript a.download = '';alert(document.domain);//.svg'; ``` The payload is stored in the generated HTML viewer and executes when the affected JavaScript function is invoked. In the current template, the vulnerable statement is reached when the user selects the “Download SVG” button. The same title is inserted into ordinary HTML locations, but those locations receive XML escaping. The vulnerability specifically results from reusing XML-escaped data in a JavaScript-string context. Blueprint validation does not constrain `meta.title`, and the export command does not automatically reject dangerous title characters. ### Attack Path 1. An attacker supplies requirements, meeting notes, or blueprint data containing a crafted title. 2. The agent records that value in `m ...[truncated 1113 chars]- Remediation
View remediation
';alert(1);// ${expression} ``` 7. Ensure tests open or parse the generated viewer and verify that hostile values remain data rather than executable syntax. ]]>