T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/business_blueprint/assets/viewer.html:431- Finding
Stored HTML Attribute Injection in Generated Blueprint Viewer
- Content
View full analysis
${kindLabel(kind)}${esc(entity.name || entity.id)}${desc ? `${esc(desc.substring(0, 80))}` : ""} ${links ? `${links}` : ""} `; } function kindLabel(kind) { const labels = { capability: "Capability", system: "System", actor: "Actor", flowStep: "Flow Step" }; return labels[kind] || kind; } function buildLinksHtml(entity, kind) { const parts = []; if (entity.capabilityIds?.length) parts.push(...entity.capabilityIds.map(id => `${esc(id)}`)); if (entity.supportingSystemIds?.length) parts.push(...entity.supportingSystemIds.map(id => `${esc(id)}`)); if (entity.ownerActorIds?.length) parts.push(...entity.ownerActorIds.map(id => `${esc(id)}`)); return parts.join(""); } function esc(str) { const div = document.createElement("div"); div.textContent = str; return div.innerHTML; } // ── Node selection → detail panel ────────────────────── function selectNode(id) { selectedNodeId = id; document.querySelectorAll(".node-card").forEach(c => c.classList.remove("selected")); document.querySelector(`.node-card[data-id="${id}"]`)?.classList.add("selected"); ``` ### Technical Analysis Blueprint entity identifiers are inserted directly into the `data-id` HTML attribute: ```javascript data-id="${entity.id}" ``` Unlike entity names, descriptions, and related ide ...[truncated 2717 chars]- Remediation
View remediation