Summary
The Fossil Record visualizer renders attestation history fields into D3 tooltip HTML without output encoding.
The page loads /api/attestations/history, normalizes records in processData(), aggregates miner IDs into d.miners, and then renders the tooltip with tooltip.html(html). The tooltip previously interpolated:
d.epoch- architecture labels derived from
d.arch
- count and average values
sampleMiners.join(', ') from API-provided miner IDs
showError(message) also interpolated exception messages into container.html().
Impact
If a malicious or compromised attestation history source returns a miner ID or other tooltip field containing markup, opening the Fossil Record page and hovering a point can execute that markup in the visualizer origin. Error paths can similarly render raw HTML if an exception message contains markup.
Reproduction sketch
- Return an attestation history row with
miner_id set to <script>alert(1)</script>.
- Open
fossils/index.html and hover an aggregated point that includes that miner.
- The tooltip builds an HTML string and calls
tooltip.html(html), rendering the miner ID without escaping.
Expected behavior
Tooltip and error-message dynamic values should be HTML-escaped before they are passed to .html(), and numeric tooltip values should be coerced before formatting.
Summary
The Fossil Record visualizer renders attestation history fields into D3 tooltip HTML without output encoding.
The page loads
/api/attestations/history, normalizes records inprocessData(), aggregates miner IDs intod.miners, and then renders the tooltip withtooltip.html(html). The tooltip previously interpolated:d.epochd.archsampleMiners.join(', ')from API-provided miner IDsshowError(message)also interpolated exception messages intocontainer.html().Impact
If a malicious or compromised attestation history source returns a miner ID or other tooltip field containing markup, opening the Fossil Record page and hovering a point can execute that markup in the visualizer origin. Error paths can similarly render raw HTML if an exception message contains markup.
Reproduction sketch
miner_idset to<script>alert(1)</script>.fossils/index.htmland hover an aggregated point that includes that miner.tooltip.html(html), rendering the miner ID without escaping.Expected behavior
Tooltip and error-message dynamic values should be HTML-escaped before they are passed to
.html(), and numeric tooltip values should be coerced before formatting.