T08 · Insecure Dependencies
Warning
- Location
- templates/en/dark-tech.html:7
- Finding
- Generated reports execute mutable third-party JavaScript without integrity protection## Vulnerability Details **File Location**: `templates/en/dark-tech.html:7-9, 963-976` **Vulnerability Type**: Third-party JavaScript supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```html <script src="https://cdn.jsdelivr.net/npm/chart.js@4/dist/chart.umd.min.js"></script> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/github-dark.min.css"> <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"></script> ``` ```javascript /* Preload html2canvas eagerly — fires while user reads, so first export is instant */ let libPromise = null; function loadLib() { if (libPromise) return libPromise; libPromise = new Promise(resolve => { if (window.html2canvas) { resolve(); return; } const s = document.createElement('script'); s.src = 'https://cdn.jsdelivr.net/npm/html2canvas@1/dist/html2canvas.min.js'; s.onload = resolve; document.head.appendChild(s); }); return libPromise; } loadLib(); /* start loading immediately */ ``` The same design is prescribed in `references/html-shell/export.md:51`, `references/rendering/chart.md:7`, and `references/rendering/media-code-callout.md:21`, and appears in multiple English and Chinese templates. ### Technical Analysis Generated reports execute JavaScript obtained from third-party CDNs. Some dependencies use mutable major-version selectors such as `@1`, `@4`, `@5`, and `@11`, and the static imports do not provide Subresource Integrity metadata. Consequently, the executable content delivered to a report can change after the Skill package has been audited. The `html2canvas` dependency is loaded eagerly when the report opens rather than only after the user requests an export. This creates an external request and grants third-party code access to the report's browser context even when image export is never used. The inspected export code does not explicitly ...[truncated 1613 chars]
- Remediation
- ## Remediation Suggestions 1. Make bundled, locally audited dependencies the default for generated reports. 2. Pin every browser dependency to an exact reviewed version rather than a major-version selector. 3. Add `integrity` hashes and `crossorigin="anonymous"` to static CDN script and stylesheet imports when remote loading remains supported. 4. Load `html2canvas` only after an explicit user click on an image-export action; remove the eager `loadLib()` invocation. 5. Apply a restrictive Content Security Policy. In particular, constrain `script-src`, `connect-src`, `img-src`, and `style-src` to the minimum required sources. 6. Ensure bundled dependencies are obtained through a reproducible process with checksums or a lock file, and review dependency updates before release. 7. Clearly disclose that non-bundled reports contact third-party CDNs and may therefore be inappropriate for confidential or offline reports. 8. Add automated quality-gate checks that reject mutable CDN version selectors and external scripts lacking approved integrity hashes.