T08 · Insecure Dependencies
Warning
- Location
- iteration/references/templates/prototype-template.html:11
- Finding
- Unpinned Third-Party JavaScript Dependencies Without Integrity Verification## Vulnerability Details **File Location**: `iteration/references/templates/prototype-template.html`, lines 11-14 **Vulnerability Type**: External dependency supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```html <script crossorigin src="https://unpkg.com/react@18/umd/react.production.min.js"></script> <script crossorigin src="https://unpkg.com/react-dom@18/umd/react-dom.production.min.js"></script> <script src="https://unpkg.com/@babel/standalone/babel.min.js"></script> <script src="https://cdn.tailwindcss.com"></script> ``` ### Technical Analysis The prototype template loads and executes JavaScript from third-party CDNs whenever the generated HTML file is opened. The React resources use mutable major-version aliases, while the Babel and Tailwind resources do not specify versions. None of the resources includes a Subresource Integrity hash. Consequently, the effective executable code can change after the Skill package has been reviewed. A compromised CDN, compromised upstream package, malicious package release, DNS or network interception scenario, or unexpected change to a mutable alias could cause generated prototypes to execute unauthorized JavaScript. The `crossorigin` attribute does not verify resource integrity. Without an `integrity` attribute containing a trusted cryptographic hash, the browser has no mechanism to determine whether the downloaded script is the exact version approved by the project author. ### Attack Path 1. An attacker compromises one of the referenced CDN resources, an upstream package release, or the resolution of a mutable version alias. 2. The Skill generates a prototype based on this template. 3. A user opens the generated prototype while network access is available. 4. The browser retrieves the modified JavaScript from the external CDN. 5. The browser executes that code in the prototype page context without integrity verification. 6. The malicious script can inspect or modify prototype content, read brow ...[truncated 994 chars]
- Remediation
- ## Remediation Suggestions 1. **Bundle dependencies locally** - Download reviewed releases of React, ReactDOM, Babel, and Tailwind during a controlled build process. - Store the required compiled assets within the project or package. - Serve generated prototypes without runtime dependency retrieval. 2. **Pin exact immutable versions** - Replace mutable aliases such as `react@18` with exact versions. - Specify exact versions for Babel and Tailwind. - Avoid CDN endpoints whose response can change without a corresponding URL change. 3. **Add Subresource Integrity** - Generate and verify SHA-384 or SHA-512 hashes for every external resource. - Add an `integrity` attribute and use `crossorigin="anonymous"`. - Update integrity hashes only after reviewing and approving dependency changes. 4. **Apply a restrictive Content Security Policy** - Limit `script-src` to explicitly approved locations and hashes. - Restrict outbound connections through `connect-src`. - Disable unnecessary object, frame, and plugin sources. 5. **Remove runtime compilers from distributed prototypes** - Precompile JSX and Tailwind CSS during generation. - Distribute static JavaScript and CSS rather than loading Babel and Tailwind's runtime CDN scripts. 6. **Establish dependency review controls** - Maintain a dependency inventory and approved-version lock file. - Monitor dependency advisories and verify checksums during updates. - Require security review before changing external assets.