T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_dashboard.js:779- Finding
Stored HTML and JavaScript Injection Through Untrusted Dashboard Data
- Content
View full analysis
Shadow AI Monitor - ${company} ``` ```javascript${company} - Employee AI Tool Usage Report
``` ```javascript ${recentEvents.map(event => ` ${new Date(event.timestamp).toLocaleString()} ${event.employee} ${event.tool} ${event.dataCategory} ${event.risk} `).join('')} ``` Input-derived data is also serialized directly into an inline script: ```javascript const employeeDrilldown = ${JSON.stringify(employeeDrilldown)}; ``` The browser-side modal then converts input-derived values into HTML and assigns them to `innerHTML`: ```javascript const eventsHTML = data.topRiskyEvents.map(event => ``).join(''); document.getElementById('modalEvents').innerHTML = eventsHTML; ``` ### Technical Analysis The input file path is supplied through `process.argv[2]`, and all parsed fields are treated as trusted. No schema enforcement, type checking, HTML escaping, or JavaScript-context escaping is performed before input-derived values are inserted into the generated document. Values such as `company`, `event.em ...[truncated 2361 chars]${event.tool} - ${event.category}📅 ${event.date} ${event.risk} Risk- Remediation
View remediation
`, `"`, and `'`. 3. Do not construct the modal with `innerHTML`. Create DOM elements and assign untrusted values through `textContent`: ```javascript const tool = document.createElement('strong'); tool.textContent = event.tool; const category = document.createTextNode(` - ${event.category}`); container.append(tool, category); ``` 4. Avoid placing serialized user data inside an executable inline script. Prefer a separate JSON file fetched and parsed as data. If inline JSON is necessary, place it in a non-executable element such as: ```html ``` The serialized content must still escape HTML parser-sensitive characters, including `<`, `>`, `&`, U+2028, and U+2029. In particular, replace `<` with `\u003c` so that `` cannot terminate the element. 5. Add a restrictive Content Security Policy. After removing inline handlers and inline scripts, use a policy similar to: ```html ``` 6. Add regression tests containing payloads in every string field, including: - `` - `` - Quotes, ampersands, angle brackets, and Unicode line separators Verify that these value ...[truncated 80 chars]