T09 · Insecure Skill Coding Practices
Warning
- Location
- assets/minor-protection/SPL-anthropic-minor-server.py:403
- Finding
- DOM-based cross-site scripting in the local chat interface<![CDATA[ ## Vulnerability Details **File Location**: `assets/minor-protection/SPL-anthropic-minor-server.py`, lines 403–408 **Vulnerability Type**: DOM-based cross-site scripting through unsafe HTML rendering **Risk Level**: Medium ### Vulnerable Code ```javascript function add(role, text, status, crisis){ var box=document.getElementById('chat'); var d=document.createElement('div'); d.className='msg '+(crisis?('agent crisis'):role); var s=''; if(status){s='<span class="status">'+status.map(function(t){return '<span class="tag'+(t.hot?' hot':'')+'">'+t.name+' '+t.val+'</span>'}).join('')+'</span>';} d.innerHTML=text+s+'<span class="meta">'+(role==='user'?'you':'SPL partner')+'</span>'; box.appendChild(d); box.scrollTop=box.scrollHeight; } ``` The displayed labels in the original source are localized, but the vulnerable operation is the assignment of attacker-controlled `text` to `d.innerHTML`. ### Technical Analysis The `text` argument is populated directly from chat input and is rendered using `innerHTML` without encoding or sanitization. Consequently, the browser interprets HTML supplied by a user instead of treating it as plain conversation text. The same rendering function displays both user messages and server replies. User input reaches it directly through `add('user', t)`, so exploitation does not depend on the server reflecting the input. Because the page does not deploy a restrictive Content Security Policy, injected elements with executable event handlers can run JavaScript in the chat application's origin. ### Attack Path 1. An attacker prepares a message containing an HTML element with an executable event handler. 2. The attacker convinces a user to submit or paste that message into the chat interface. 3. The `send()` function invokes `add('user', t)` before sending the request. 4. `add()` assigns the message to `d.innerHTML`. 5. The browser creates the attacker-controlled element and executes its handler. 6. The injected script ca ...[truncated 683 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Replace `innerHTML` with `textContent` for all conversation text. - Construct status and metadata elements through `document.createElement()` and assign their values through `textContent`. - If limited formatting is required, pass content through a well-maintained sanitizer with a strict element and attribute allowlist. - Add a restrictive Content Security Policy that disallows inline script and inline event handlers. - Add regression tests using messages containing tags, entity encodings, SVG elements, and event-handler attributes. ]]>