From de4e16b4e1d557339d725c77c13d5d161c9b5282 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Mon, 12 Oct 2026 20:11:30 +0000
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]?=
=?UTF-8?q?=20=EB=8C=80=EC=8B=9C=EB=B3=B4=EB=93=9C=20=EB=82=B4=20Prototype?=
=?UTF-8?q?=20Pollution=20=EB=B0=8F=20DOM=20XSS=20=EC=B7=A8=EC=95=BD?=
=?UTF-8?q?=EC=A0=90=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
.jules/sentinel.md | 4 +
scanner/dashboard/index.html | 11 +-
scanner/dashboard/index.html.orig | 393 ++++++++++++++++++++++++++++++
3 files changed, 404 insertions(+), 4 deletions(-)
create mode 100644 scanner/dashboard/index.html.orig
diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 1600d4323..29f20f1e4 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -127,3 +127,7 @@
**Vulnerability:** The `/api/v1/webhook` POST endpoint in `appguardrail_core/controlplane.py` failed to validate the `url` property when accepting it into the database, leading to Stored SSRF risks. In addition, the core SSRF validation logic (`_is_safe_url`) in both the CLI and control-plane did not verify the input type (e.g. `isinstance(url, str)`). Passing non-string types (like integers) resulted in unhandled `AttributeError` exceptions inside `urllib.parse.urlparse`, which led to API 500 crashes on malicious JSON payloads.
**Learning:** Network endpoints must explicitly validate the data type of user-provided configurations prior to execution or storage. Furthermore, webhooks configured by users should always be checked for SSRF when saved, as trusting them later assumes input has already been safely validated, bypassing downstream network guardrails.
**Prevention:** Apply `_is_safe_url` checks directly upon ingestion (e.g., in `/api/v1/webhook`) and enforce type checks `if not isinstance(url, str): return False` prior to using library parsing functions like `urlparse`. Always return gracefully failing responses (like `400 Bad Request`) for unsafe URLs instead of allowing unhandled 500 server errors.
+## 2026-10-12 - [Prototype Pollution and DOM XSS via unescaped object properties in dashboard]
+**Vulnerability:** The dashboard UI used user-controlled severity strings directly as object keys for maps like `counts` and `SEV` without ensuring the property exists, creating a vector for Prototype Pollution and DOM XSS (e.g., using `__proto__` to inject unexpected behavior).
+**Learning:** Using simple case-transformations (`.toUpperCase()`) and dictionary defaults (`s in counts ? s : 'INFO'`) is insufficient when keys can evaluate to `__proto__` or native Javascript prototype properties.
+**Prevention:** For dictionary maps, initialize them safely using `Object.create(null)` instead of `{}`. Before rendering user input based on object lookups, ensure safe lookup by explicitly checking `Object.hasOwn(obj, input) ? input : fallback` to avoid prototype escalation.
diff --git a/scanner/dashboard/index.html b/scanner/dashboard/index.html
index 132bc31b2..671c9eadf 100644
--- a/scanner/dashboard/index.html
+++ b/scanner/dashboard/index.html
@@ -170,11 +170,12 @@
Clean scan
return;
}
const counts = {CRITICAL:0,HIGH:0,WARNING:0,INFO:0};
- const byCat = {};
+ const byCat = Object.create(null);
let blocking = 0;
for(const f of ALL){
const s = String(f.severity||'INFO').toUpperCase();
- counts[s in counts ? s : 'INFO']++;
+ const sevKey = Object.hasOwn(counts, s) ? s : 'INFO';
+ counts[sevKey]++;
const c = String(f.category||'misconfig');
byCat[c] = (byCat[c]||0)+1;
if(isDeployBlocking(f)) blocking++;
@@ -205,9 +206,10 @@