HTML injection in the dossier
generate-dossier builds dossier.html by string concatenation with only partial
escaping. Some fields (notes, deliverable description) get minimal <-escaping; the
cover fields do not — subject, employee_name, and the company name are interpolated
raw.
Since those values are user-controlled (case subject, employee name, company name are all
entered in the app), a value like <script>… or <img onerror=…> is embedded verbatim into
the "immutable" legal artifact. Anyone who later opens the dossier HTML in a browser
executes it — and because the same values also render across the app, this is a stored-XSS
surface beyond the dossier.
The irony: the document footer asserts "snapshot imutável do processo" — a tampered or injected cover undermines exactly the integrity the dossier is meant to guarantee.
Rebuild implication
Never build HTML by concatenation. Use a real templating engine with contextual auto-escaping (or generate a signed PDF from structured data). Sanitise/escape all interpolated fields, and validate input at entry. Treat the dossier as tamper-evident (hash/sign the output).