T09 · Insecure Skill Coding Practices
Warning
- Location
examples/example-map.js:28- Finding
JavaScript Injection in Generated Map HTML
- Content
View full analysis
!routeFilter || b.RouteID === routeFilter) .map(b => `{ id: '${b.BusID}', lat: ${b.lat}, lng: ${b.lng}, route: '${b.RouteID}', status: '${b.CarOnStop === '1' ? '停站' : '行駛中'}', direction: '${b.GoBack === '1' ? '去程' : '返程'}', updated: '${b.DataTime}' }`) .join(',\n'); ``` ### Technical Analysis The function constructs JavaScript object literals by directly interpolating record fields into executable script content. Values such as `BusID`, `RouteID`, and `DataTime` are inserted inside single-quoted JavaScript strings without escaping. The latitude and longitude fields are inserted directly as JavaScript expressions without numeric validation. If a caller supplies an attacker-controlled record, a crafted string can terminate the intended literal and inject arbitrary JavaScript. For example, a malicious identifier containing a quote, object terminator, and script expression could escape the `id` value and execute when the generated HTML is opened. The vulnerability is present even though the included example does not currently invoke `generateMapHTML()` with live records. The function is provided as an implementation framework, so applications that reuse it with untrusted, compromised, or insufficiently validated data inherit the flaw. ### Attack Path 1. An application imports or copies `generateMapHTML()` and supplies transit records from an external API, cache, user input, or another untrusted source. 2. An attacker causes a string field such as `BusID`, `RouteID`, or `DataTime` to contain JavaScript syntax that escapes its quoted value. 3. `generateMapHTML()` incorporates the value into the inline script without contextual encoding. 4. The application saves or ...[truncated 824 chars]- Remediation
View remediation
` element. 3. Validate `lat` and `lng` with `Number.isFinite()` and reject records containing nonnumeric coordinates. 4. Normalize expected string fields and enforce reasonable length limits. 5. Prefer placing serialized data in a non-executable `