T09 · Insecure Skill Coding Practices
Error
- Location
references/custom-overlay.md:127- Finding
Unsafe Dynamic HTML Construction Enables DOM-Based Cross-Site Scripting
- Content
View full analysis
${this.properties.title}
${this.properties.desc}
`; ``` ### Technical Analysis The example directly interpolates `imgSrc`, `title`, and `desc` into an HTML string assigned to `innerHTML`. No output encoding, HTML sanitization, or URL validation is performed. If an application populates these properties using URL parameters, API responses, database records, map feature attributes, or other attacker-controlled input, the browser will interpret that input as markup rather than plain text. An attacker can consequently inject elements with event handlers or other active HTML. For example, a malicious title could close the existing heading and introduce an image with an error handler. The vulnerability exists in the generated application code rather than in the documentation renderer itself, but users following the example can reproduce the flaw directly. ### Attack Path 1. An application follows the documented `createInfoCard` implementation. 2. The application obtains an overlay property such as `title`, `desc`, or `imgSrc` from an untrusted source. 3. An attacker supplies a value containing crafted HTML or an event-handler payload. 4. The value is interpolated into the template literal without encoding. 5. The resulting string is assigned to `div.innerHTML`. 6. The browser parses the attacker's value as active markup. 7. The injected JavaScript executes in the origin and security context of the integrating application. ### Impact Assessment Successful exploitation can execute arbitrary client-side JavaScript in the affected application's origin. Depending on the application's authentication and browser defenses, an attacker ...[truncated 547 chars]- Remediation
View remediation