T08 · Insecure Dependencies
Warning
- Location
assets/chartjs-bar-template.html:7- Finding
Mutable Third-Party JavaScript Is Loaded Without Integrity Verification
- Content
View full analysis
``` The generation requirements mandate the same Chart.js dependency: ```html ``` They also mandate a D3.js dependency pinned only to a mutable major-version range: ```html ``` ### Technical Analysis Generated visualization files retrieve and execute JavaScript supplied by `cdn.jsdelivr.net` when opened in a browser. The Chart.js reference does not specify any version, while the D3.js reference allows any release within major version 7. Neither reference provides a Subresource Integrity hash. Consequently, the effective JavaScript payload is not fixed at audit time. It may change because of an upstream package release, package-registry compromise, CDN compromise, or unauthorized modification of the published package. The requirements explicitly state that these CDN imports must be used, causing generated complex visualizations to inherit the risk. No evidence indicates that the currently referenced libraries are malicious. The vulnerability is the absence of controls that ensure the reviewed dependency is the same code later executed by users. ### Attack Path 1. The Skill generates a complex visualization using the mandatory Chart.js or D3.js CDN import. 2. A user opens the generated HTML file or deploys it to a website. 3. The browser requests JavaScript from the external CDN. 4. An attacker compromises the upstream package, its publishing account, the package-delivery path, or th ...[truncated 1031 chars]- Remediation
View remediation
``` 2. Apply the same exact-version and Subresource Integrity controls to D3.js: ```html ``` 3. Generate integrity hashes from independently verified release artifacts and update them only after reviewing the corresponding dependency release. 4. Prefer vendored, audited local copies of the libraries for offline, sensitive, or reproducible output. This removes runtime reliance on an external code-delivery service. 5. Revise `references/viz-requirements.md` so CDN loading is optional rather than mandatory, and require exact versions whenever external resources are used. 6. Add a restrictive Content Security Policy appropriate to generated pages, limiting scripts and outbound connections to explicitly approved sources. 7. Inform users when generated output performs network requests and provide a fully self-contained output option. ]]>