T03 · Remote Payload Retrieval and Execution
Error
- Location
references/render_template.html:15- Finding
Mutable Remote JavaScript Is Retrieved and Executed During Rendering
- Content
View full analysis
import { exportToSvg } from "https://esm.sh/@excalidraw/excalidraw?bundle"; ``` `references/render_excalidraw.py:119-148`: ```python template_url = template_path.as_uri() with sync_playwright() as p: try: browser = p.chromium.launch(headless=True) except Exception as e: if "Executable doesn't exist" in str(e) or "browserType.launch" in str(e): print("ERROR: Chromium not installed for Playwright.", file=sys.stderr) print("Run: cd ~/.openclaw/skills/excalidraw-diagram && uv run playwright install chromium", file=sys.stderr) sys.exit(1) raise page = browser.new_page( viewport={"width": vp_width, "height": vp_height}, device_scale_factor=scale, ) # Load the template page.goto(template_url) # Wait for the ES module to load (imports from esm.sh) page.wait_for_function("window.__moduleReady === true", timeout=30000) # Inject the diagram data and render json_str = json.dumps(data) result = page.evaluate(f"window.renderDiagram({json_str})") ``` ### Technical Analysis The reference renderer opens a local HTML document that imports an Excalidraw module directly from `esm.sh`. The URL does not pin an exact package version or immutable artifact and does not use a cryptographic integrity check. Consequently, the JavaScript executed by Chromium can change after this project has been reviewed. The remote module executes in the rendering page before `window.renderDiagram` processes the supplied Excalidraw document. This gives the downloaded payload access to page-visible diagram data and the browser execution context. The ...[truncated 1463 chars]- Remediation
View remediation