Skip to main content

HTML injection in the dossier

generate-dossier builds dossier.html by string concatenation with only partial escaping. Some fields (notes, deliverable description) get minimal <-escaping; the cover fields do notsubject, employee_name, and the company name are interpolated raw.

Since those values are user-controlled (case subject, employee name, company name are all entered in the app), a value like <script>… or <img onerror=…> is embedded verbatim into the "immutable" legal artifact. Anyone who later opens the dossier HTML in a browser executes it — and because the same values also render across the app, this is a stored-XSS surface beyond the dossier.

The irony: the document footer asserts "snapshot imutável do processo" — a tampered or injected cover undermines exactly the integrity the dossier is meant to guarantee.

Rebuild implication

Never build HTML by concatenation. Use a real templating engine with contextual auto-escaping (or generate a signed PDF from structured data). Sanitise/escape all interpolated fields, and validate input at entry. Treat the dossier as tamper-evident (hash/sign the output).