🛡️ Sentinel: [HIGH] Fix DOM XSS via type coercion and escaping

.jules/sentinel.md

@@ -127,3 +127,7 @@
 **Vulnerability:** The `/api/v1/webhook` POST endpoint in `appguardrail_core/controlplane.py` failed to validate the `url` property when accepting it into the database, leading to Stored SSRF risks. In addition, the core SSRF validation logic (`_is_safe_url`) in both the CLI and control-plane did not verify the input type (e.g. `isinstance(url, str)`). Passing non-string types (like integers) resulted in unhandled `AttributeError` exceptions inside `urllib.parse.urlparse`, which led to API 500 crashes on malicious JSON payloads.
 **Learning:** Network endpoints must explicitly validate the data type of user-provided configurations prior to execution or storage. Furthermore, webhooks configured by users should always be checked for SSRF when saved, as trusting them later assumes input has already been safely validated, bypassing downstream network guardrails.
 **Prevention:** Apply `_is_safe_url` checks directly upon ingestion (e.g., in `/api/v1/webhook`) and enforce type checks `if not isinstance(url, str): return False` prior to using library parsing functions like `urlparse`. Always return gracefully failing responses (like `400 Bad Request`) for unsafe URLs instead of allowing unhandled 500 server errors.
+## 2024-10-08 - Prevent DOM XSS in Dashboard
+**Vulnerability:** Untrusted numerical and string data were being directly interpolated into `innerHTML` statements without escaping or numeric coercion.
+**Learning:** Type coercion (e.g., `Number()`) acts as a secure mitigating factor for numeric types when dynamically generating DOM content, while string sanitization (like `esc()`) is best for arbitrary strings.
+**Prevention:** Always coerce untrusted input payloads dynamically fetched and set on `innerHTML` into expected strict types (like `Number`) or explicitly escape them before insertion.

scanner/dashboard/console.html

@@ -121,19 +121,19 @@ <h1>AppGuardrail Console</h1>
     const latest=scans[0]||{severity_counts:{}};
     const c=latest.severity_counts||{};
     $("#stats").innerHTML=[
-      ["Latest deploy-blocking",latest.deploy_blocking||0],
-      ["New since last scan",latest.new_blocking||0],
-      ["Critical",c.CRITICAL||0],
+      ["Latest deploy-blocking",Number(latest.deploy_blocking)||0],
+      ["New since last scan",Number(latest.new_blocking)||0],
+      ["Critical",Number(c.CRITICAL)||0],
       ["Scans stored",scans.length],
     ].map(([l,n])=>`<div class="stat"><div class="l">${l}</div><div class="n">${n}</div></div>`).join("");
     const ord=[...scans].reverse();
-    const max=Math.max(1,...ord.map(s=>s.deploy_blocking||0));
-    $("#trend").innerHTML=ord.map(s=>{const h=Math.round(6+((s.deploy_blocking||0)/max)*54);
-      const col=(s.deploy_blocking||0)>0?"var(--crit)":"var(--ok)";
+    const max=Math.max(1,...ord.map(s=>Number(s.deploy_blocking)||0));
+    $("#trend").innerHTML=ord.map(s=>{const h=Math.round(6+((Number(s.deploy_blocking)||0)/max)*54);
+      const col=(Number(s.deploy_blocking)||0)>0?"var(--crit)":"var(--ok)";
       return `<div class="bar" tabindex="0" role="img" aria-label="${esc(s.created_at)}: ${esc(String(s.deploy_blocking||0))} blocking" title="${esc(s.created_at)}: ${esc(String(s.deploy_blocking||0))} blocking" style="height:${h}px;background:${col}"></div>`;}).join("")||'<span class="muted">No scans yet.</span>';
-    $("#history tbody").innerHTML=scans.map(s=>`<tr class="scan" data-id="${s.id}" tabindex="0" role="button" title="View scan details">
+    $("#history tbody").innerHTML=scans.map(s=>`<tr class="scan" data-id="${esc(s.id)}" tabindex="0" role="button" title="View scan details">
       <td>${esc(s.created_at)}</td><td>${esc(s.repo||"—")}</td><td><code>${esc((s.commit||"—").slice(0,10))}</code></td>
-      <td>${s.total}</td><td>${pill(s.deploy_blocking,"var(--crit)")}</td><td>${pill(s.new_blocking,"var(--high)")}</td></tr>`).join("")||'<tr><td colspan="6" class="muted">No scans. POST to /api/v1/scans from CI.</td></tr>';
+      <td>${Number(s.total)||0}</td><td>${pill(Number(s.deploy_blocking)||0,"var(--crit)")}</td><td>${pill(Number(s.new_blocking)||0,"var(--high)")}</td></tr>`).join("")||'<tr><td colspan="6" class="muted">No scans. POST to /api/v1/scans from CI.</td></tr>';
     document.querySelectorAll("tr.scan").forEach(tr=>{
       tr.onclick=()=>detail(tr.dataset.id,tr);
       tr.addEventListener('keydown', e => { if(e.key === 'Enter' || e.key === ' ') { e.preventDefault(); detail(tr.dataset.id,tr); } });
@@ -155,7 +155,7 @@ <h1>AppGuardrail Console</h1>
   try{
     const s=await api("/api/v1/scans/"+id);
     if(requestId!==currentDetailRequest)return;
-    const rows=(s.findings||[]).map(f=>`<tr><td><span class="pill" style="background:${SEV[f.severity]||'var(--info)'}">${esc(f.severity)}</span></td>
+    const rows=(s.findings||[]).map(f=>`<tr><td><span class="pill" style="background:${SEV[String(f.severity).toUpperCase()]||'var(--info)'}">${esc(f.severity)}</span></td>
       <td><code>${esc(f.rule_id)}</code></td><td>${esc((f.message||"").split("\n")[0].slice(0,120))}</td>
       <td><code>${esc(f.file)}:${esc(f.line)}</code></td></tr>`).join("");
     d.innerHTML=`<button type="button" class="close-btn" aria-label="Close details">✕</button><strong>Scan #${esc(s.id)}</strong> <span class="muted">${esc(s.created_at)} · ${esc(s.repo||"—")}</span>