{"record":{"id":"e30f84542399ea44","repo":"davila7/claude-code-templates","slug":"sem-e014","errorCode":"SEM_E014","errorMessage":"<script> tag detected (XSS risk)","messagePattern":"<script> tag detected \\(XSS risk\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli-tool/src/validation/validators/SemanticValidator.js","lineNumber":286,"sourceCode":"          };\n        });\n\n        this.addError(code, message, {\n          path,\n          severity,\n          matches: contexts.length,\n          examples: contexts.slice(0, 3)\n        });\n      }\n    }\n  }\n\n  /**\n   * Check for HTML/Script injection attempts\n   */\n  checkHtmlInjection(content, path) {\n    const dangerousTags = [\n      { tag: '<script', code: 'SEM_E014', message: '<script> tag detected (XSS risk)' },\n      { tag: '<iframe', code: 'SEM_E015', message: '<iframe> tag detected (injection risk)' },\n      { tag: 'javascript:', code: 'SEM_E016', message: 'javascript: protocol detected (XSS risk)' },\n      { tag: 'onclick=', code: 'SEM_E017', message: 'Inline event handler detected (XSS risk)' },\n      { tag: 'onerror=', code: 'SEM_E018', message: 'onerror handler detected (XSS risk)' }\n    ];\n\n    for (const { tag, code, message } of dangerousTags) {\n      const lowerContent = content.toLowerCase();\n      if (lowerContent.includes(tag.toLowerCase())) {\n        const index = lowerContent.indexOf(tag.toLowerCase());\n        const lineInfo = this.getLineFromIndex(content, index);\n\n        this.addError(code, message, {\n          path,\n          severity: 'critical',\n          line: lineInfo.line,\n          column: lineInfo.column,\n          position: lineInfo.position,","sourceCodeStart":268,"sourceCodeEnd":304,"githubUrl":"https://github.com/davila7/claude-code-templates/blob/a0851ed10c7c60463dac8cfaaca124cf32d5804d/cli-tool/src/validation/validators/SemanticValidator.js#L268-L304","documentation":"SEM_E014 is emitted by checkHtmlInjection (called from validate step 4) when the lowercased component content contains the substring '<script'. Components are markdown rendered/installed into user environments, and embedded script tags are a cross-site-scripting or code-execution vector, so any occurrence is reported.","triggerScenarios":"validate() where content.toLowerCase().includes('<script') — any occurrence, including '<scripting', '<script.js', or markdown/HTML examples that show a script tag in a code fence. Match is substring-based, not tag-parsed.","commonSituations":"Command/agent docs that include HTML examples with <script> inside code blocks; references to files like 'my<script notes'; template components that embed inline analytics scripts.","solutions":["Remove the literal '<script' text — use escaped or spaced forms in examples ('< script' or '&lt;script&gt;') inside code fences","Move any real JavaScript to a referenced external file instead of inline script tags","If the tag appears inside an illustrative code block, rewrite the example to reference a .js file: '<script src=\"...\">' still matches — describe it in prose instead"],"exampleFix":"# before\n<script>console.log('hi')</script>\n# after\n&lt;script&gt;console.log('hi')&lt;/script&gt;  (escaped in docs)","handlingStrategy":"validation","validationCode":"if (component.content.toLowerCase().includes('<script')) {\n  // escape (&lt;script) or remove before validating\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Escape HTML in markdown code examples","Reference external .js files instead of inline scripts","Grep components for '<script' before publishing"],"tags":["xss","html-injection","static-analysis"],"backgroundTag":"xss-script-tag-detected","analyzedSha":"a0851ed10c7c60463dac8cfaaca124cf32d5804d","analyzedAt":"2026-08-28T14:11:56.058Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}