T09 · Insecure Skill Coding Practices
Error
- Location
assets/iq_test_template.html:385- Finding
DOM-Based Cross-Site Scripting Through Unsanitized Quiz Content
- Content
View full analysis
Question ${index + 1} ${q.category}${q.question}`; if (q.type === 'multiple_choice' && q.options) { html += ''; q.options.forEach((opt, i) => { const letter = String.fromCharCode(65 + i); const selected = userAnswers[index] === opt ? 'selected' : ''; html += `'; } else { const value = userAnswers[index] || ''; html += ``; } html += `${letter} ${opt}`; }); html += 'Explanation: ${q.explanation}`; container.innerHTML = html; } ``` The results view contains the same underlying issue: ```javascript breakdownHtml += `${cat}${data.correct}/${data.total} (${catPct}%)- Remediation
View remediation
`, `&`, and ``. 7. Add a restrictive Content Security Policy where the generated test is hosted. Avoid `unsafe-inline` by removing inline handlers. A suitable baseline should restrict scripts to trusted same-origin resources and block object embedding. 8. Add automated tests using payloads in every rendered field, including question text, categories, options, explanations, correct answers, and typed answers. Verify that payloads appear only as literal text and never create executable DOM elements. ]]>