T09 · Insecure Skill Coding Practices
Error
- Location
assets/index.html:88- Finding
Stored DOM XSS Through Unescaped Filesystem Names and Paths
- Content
View full analysis
..dir---`; rowsEl.appendChild(tr); } for (const e of data.entries) { const itemPath = p ? `${p}\\${e.name}` : e.name; const tr = document.createElement('tr'); const action = e.isDirectory ? `Open` : `Download`; tr.innerHTML = ` ${e.isDirectory ? '📁' : '📄'} ${e.name} ${e.isDirectory ? 'dir' : 'file'} ${e.isDirectory ? '-' : fmtSize(e.size)} ${e.modified || '-'} ${action}`; rowsEl.appendChild(tr); } ``` ### Technical Analysis Filesystem-derived values such as `e.name` and `itemPath`, as well as the user-controlled path value used to construct `up`, are interpolated directly into HTML and attribute contexts before being assigned to `innerHTML`. Neither HTML text escaping nor attribute escaping is applied. A maliciously constructed filename or directory name containing HTML markup can therefore alter the generated document structure and introduce executable event handlers or other active content. This is a stored DOM XSS condition because the payload can persist as a filesystem entry and execute whenever an authenticated operator browses the affected directory. The injected script runs under the local server's origin. It can access the token input and URL, issue same-origin authenticated requests, inspect directory listings, and retrieve files available through the service. ### Attack P ...[truncated 1329 chars]- Remediation
View remediation