davila7/claude-code-templates · error

SEM_E014

SEM_E014

Error message

<script> tag detected (XSS risk)

What it means

SEM_E014 is emitted by checkHtmlInjection (called from validate step 4) when the lowercased component content contains the substring '<script'. Components are markdown rendered/installed into user environments, and embedded script tags are a cross-site-scripting or code-execution vector, so any occurrence is reported.

Source

Thrown at cli-tool/src/validation/validators/SemanticValidator.js:286

          };
        });

        this.addError(code, message, {
          path,
          severity,
          matches: contexts.length,
          examples: contexts.slice(0, 3)
        });
      }
    }
  }

  /**
   * Check for HTML/Script injection attempts
   */
  checkHtmlInjection(content, path) {
    const dangerousTags = [
      { tag: '<script', code: 'SEM_E014', message: '<script> tag detected (XSS risk)' },
      { tag: '<iframe', code: 'SEM_E015', message: '<iframe> tag detected (injection risk)' },
      { tag: 'javascript:', code: 'SEM_E016', message: 'javascript: protocol detected (XSS risk)' },
      { tag: 'onclick=', code: 'SEM_E017', message: 'Inline event handler detected (XSS risk)' },
      { tag: 'onerror=', code: 'SEM_E018', message: 'onerror handler detected (XSS risk)' }
    ];

    for (const { tag, code, message } of dangerousTags) {
      const lowerContent = content.toLowerCase();
      if (lowerContent.includes(tag.toLowerCase())) {
        const index = lowerContent.indexOf(tag.toLowerCase());
        const lineInfo = this.getLineFromIndex(content, index);

        this.addError(code, message, {
          path,
          severity: 'critical',
          line: lineInfo.line,
          column: lineInfo.column,
          position: lineInfo.position,

View on GitHub (pinned to a0851ed10c)

Solutions

  1. Remove the literal '<script' text — use escaped or spaced forms in examples ('< script' or '&lt;script&gt;') inside code fences
  2. Move any real JavaScript to a referenced external file instead of inline script tags
  3. If the tag appears inside an illustrative code block, rewrite the example to reference a .js file: '<script src="...">' still matches — describe it in prose instead

Example fix

# before
<script>console.log('hi')</script>
# after
&lt;script&gt;console.log('hi')&lt;/script&gt;  (escaped in docs)
Defensive patterns

Strategy: validation

Validate before calling

if (component.content.toLowerCase().includes('<script')) {
  // escape (&lt;script) or remove before validating
}

Prevention

When it happens

Trigger: validate() where content.toLowerCase().includes('<script') — any occurrence, including '<scripting', '<script.js', or markdown/HTML examples that show a script tag in a code fence. Match is substring-based, not tag-parsed.

Common situations: Command/agent docs that include HTML examples with <script> inside code blocks; references to files like 'my<script notes'; template components that embed inline analytics scripts.

Related errors

AI-assisted analysis of davila7/claude-code-templates@a0851ed10c (2026-08-28). Data as JSON: /api/errors/e30f84542399ea44. Report an issue: GitHub.