{"record":{"id":"5d28640446b95c50","repo":"davila7/claude-code-templates","slug":"sem-e015","errorCode":"SEM_E015","errorMessage":"<iframe> tag detected (injection risk)","messagePattern":"<iframe> tag detected \\(injection risk\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli-tool/src/validation/validators/SemanticValidator.js","lineNumber":287,"sourceCode":"        });\n\n        this.addError(code, message, {\n          path,\n          severity,\n          matches: contexts.length,\n          examples: contexts.slice(0, 3)\n        });\n      }\n    }\n  }\n\n  /**\n   * Check for HTML/Script injection attempts\n   */\n  checkHtmlInjection(content, path) {\n    const dangerousTags = [\n      { tag: '<script', code: 'SEM_E014', message: '<script> tag detected (XSS risk)' },\n      { tag: '<iframe', code: 'SEM_E015', message: '<iframe> tag detected (injection risk)' },\n      { tag: 'javascript:', code: 'SEM_E016', message: 'javascript: protocol detected (XSS risk)' },\n      { tag: 'onclick=', code: 'SEM_E017', message: 'Inline event handler detected (XSS risk)' },\n      { tag: 'onerror=', code: 'SEM_E018', message: 'onerror handler detected (XSS risk)' }\n    ];\n\n    for (const { tag, code, message } of dangerousTags) {\n      const lowerContent = content.toLowerCase();\n      if (lowerContent.includes(tag.toLowerCase())) {\n        const index = lowerContent.indexOf(tag.toLowerCase());\n        const lineInfo = this.getLineFromIndex(content, index);\n\n        this.addError(code, message, {\n          path,\n          severity: 'critical',\n          line: lineInfo.line,\n          column: lineInfo.column,\n          position: lineInfo.position,\n          lineText: lineInfo.lineText,","sourceCodeStart":269,"sourceCodeEnd":305,"githubUrl":"https://github.com/davila7/claude-code-templates/blob/a0851ed10c7c60463dac8cfaaca124cf32d5804d/cli-tool/src/validation/validators/SemanticValidator.js#L269-L305","documentation":"SEM_E015 is emitted by checkHtmlInjection when the lowercased content contains '<iframe'. Iframes in distributed markdown can embed remote, untrusted pages (clickjacking, drive-by content), so the validator reports any occurrence as an injection risk.","triggerScenarios":"validate() on content where content.toLowerCase().indexOf('<iframe') >= 0 — including '<iframes', partial prose like 'use <iframe elements', or legit embed examples inside code fences.","commonSituations":"Component docs showing how to embed a video or dashboard via an iframe example; components that intentionally embed external tooling UIs.","solutions":["Escape the tag in documentation examples (&lt;iframe ...) or break it with a space ('< iframe')","Replace the embed with a plain markdown link to the resource","If embedding is a genuine feature, link the embed from the installed app rather than embedding it in component markdown"],"exampleFix":"# before\n<iframe src=\"https://example.com\"></iframe>\n# after\n[Open the dashboard](https://example.com)","handlingStrategy":"validation","validationCode":"if (component.content.toLowerCase().includes('<iframe')) {\n  // replace with a markdown link or escape\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Prefer markdown links over iframe embeds in distributed docs","Escape iframe examples in tutorials"],"tags":["html-injection","iframe","security"],"backgroundTag":"xss-script-tag-detected","analyzedSha":"a0851ed10c7c60463dac8cfaaca124cf32d5804d","analyzedAt":"2026-08-28T14:11:56.058Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}