Rockachopa/Timmy-time-dashboard
1
0
Fork 2
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

[HIGH] XSS vulnerability in swarm_live.html (WebSocket data not sanitized) #47

New Issue
Closed
opened 2026-03-14 18:46:52 +00:00 by kimi · 0 comments
kimi commented 2026-03-14 18:46:52 +00:00
Collaborator
Copy Link

Problem

Line 201 in swarm_live.html uses unsanitized WebSocket data in innerHTML:

// Line 201 - UNSANITIZED
node.innerHTML = `
  <div class="mc-agent-icon">${icon}</div>
  <div class="mc-agent-info">
    <div class="mc-agent-name">${label}</div>
    <div class="mc-agent-desc">${desc}</div>
  </div>
`;

Variables icon, label, and desc come from WebSocket messages without sanitization.

Impact

  • Potential XSS attack via malicious agent names/descriptions
  • Could inject JavaScript into the dashboard

Related

  • Other templates use DOMPurify correctly (agent_panel_chat.html, chat_message.html)

Acceptance Criteria

  • Add DOMPurify sanitization for icon, label, desc before innerHTML
  • Audit all other innerHTML usages in templates
  • Add Content Security Policy (CSP) nonce for inline scripts
  • Security test with malicious payloads

Priority: HIGH 🟡

## Problem Line 201 in `swarm_live.html` uses unsanitized WebSocket data in innerHTML: ```javascript // Line 201 - UNSANITIZED node.innerHTML = ` <div class="mc-agent-icon">${icon}</div> <div class="mc-agent-info"> <div class="mc-agent-name">${label}</div> <div class="mc-agent-desc">${desc}</div> </div> `; ``` Variables `icon`, `label`, and `desc` come from WebSocket messages without sanitization. ## Impact - Potential XSS attack via malicious agent names/descriptions - Could inject JavaScript into the dashboard ## Related - Other templates use DOMPurify correctly (agent_panel_chat.html, chat_message.html) ## Acceptance Criteria - [ ] Add DOMPurify sanitization for `icon`, `label`, `desc` before innerHTML - [ ] Audit all other innerHTML usages in templates - [ ] Add Content Security Policy (CSP) nonce for inline scripts - [ ] Security test with malicious payloads ## Priority: HIGH 🟡
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
222-epic
Workshop: Timmy as Presence (Epic #222)
 actionable
Has a concrete code/config task extracted
 assigned-claude
Issue currently assigned to Claude agent — do not assign to another agent
 assigned-gemini
Issue currently assigned to Gemini agent — do not assign to another agent
 assigned-groq
assigned-kimi
Issue currently assigned to Kimi agent — do not assign to another agent
 assigned-manus
Issue currently assigned to Manus agent — do not assign to another agent
 claude-ready
consolidation
Part of a consolidation epic
 deprioritized
Keep open but not blocking P0 work
 deprioritized
Keep open but not blocking P0 work
 duplicate
Duplicate of another issue
 gemini-review
Auto-generated by Gemini, needs relevance review
 groq-ready
harness
Core product: agent framework, heartbeat, inference, memory
 heartbeat
Harness: Agent heartbeat loop
 inference
Harness: Inference and model routing
 infrastructure
Supporting stage: dashboard, CI/CD, deployment, DNS
 kimi-ready
Scoped and ready for Kimi to pick up
 memory-session
Harness: Memory and session crystallization
 morrowind
Harness: Morrowind embodiment
 needs-design
Needs architectural design before implementation
 needs-extraction
Philosophy with unextracted engineering work
 p0-critical
Priority 0: Must fix now
 p1-important
Priority 1: Important, next sprint
 p2-backlog
Priority 2: Backlog, do when time permits
 philosophy
Philosophical foundation — informs architecture decisions
 rejected-direction
Closed: rejected or superseded direction
 seed:know-purpose
Three Seeds: KNOW YOUR PURPOSE
 seed:serve-real
Three Seeds: SERVE THE REAL
 seed:tell-truth
Three Seeds: TELL THE TRUTH
 sovereignty
Harness: Sovereignty stack
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Timmy claude grok groq kimi manus perplexity Rockachopa
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Rockachopa/Timmy-time-dashboard#47
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?