| # Security Threat Model: nvd3 (AppSheet Fork) |
| |
| ## Asset Definition & Scope |
| |
| - **Component:** nvd3 — a library of reusable, composable SVG chart components |
| built on D3.js v3. Upstream is `novus/nvd3`; per `METADATA` the fork's base |
| is upstream **v1.1.15b, last upgraded 2013-12-18**, i.e. a decade-old |
| snapshot that no longer tracks upstream. |
| - **Repository:** Git-on-Borg |
| (`https://gnocchi-internal.googlesource.com/third_party/nvd3`, branch |
| `main`). |
| - **Fork identity:** `package.json` declares `"version": "0.0.1"`, and the |
| Grunt uglify banner (`GruntFile.js`) stamps the artefacts accordingly — the |
| built `nv.d3.min.js` begins `/*! nvd3 - v0.0.1 - 2023-09-13 */`. The version |
| string is deliberately detached from upstream numbering, so upstream-version |
| matching by vulnerability scanners will not work on this asset. |
| - **Scope:** `src/` (the authored sources), and the concatenated/minified build |
| artefacts `nv.d3.js` and `nv.d3.min.js` produced from them by `GruntFile.js` |
| / `Makefile`. `nv.d3.css` / `.min.css` are presentational. |
| |
| > [!IMPORTANT] |
| > **This fork reaches production as a *vendored copy*, not as an npm/bower |
| > dependency.** No `package.json` in AppSheet's `jeenee` monorepo declares a |
| > dependency on `nvd3` — dependency-graph tooling will report this repository as |
| > unused. It is not. The build artefact in this repository is **byte-identical** |
| > (verified by MD5, `ba459888d567a9f5375c7d90c698e9cf`) to the file checked into |
| > the AppSheet web frontend at `jeenee/Nirvana/Scripts/app/plugins/nv.d3.min.js`, |
| > which is served to authenticated AppSheet users. This repository is the |
| > confirmed build source of live, Internet-facing production JavaScript, and |
| > findings here are directly exploitable findings in AppSheet. |
| |
| **Google-authored modification.** The single substantive fork change (commits |
| `f07d57e` "[nwd] Patching nv.d3 trusted types violations" and `189db60` "[nwd] |
| Fixing a bug - DOMPurify was not imported", kjamali@, Sept 2023) **inlines |
| DOMPurify 3.0.5 into the bundle** as `src/purify.js` and calls it from one |
| tooltip sink. Upstream nvd3 has no DOMPurify dependency; `src/purify.js` is |
| concatenated into `nv.d3.js` ahead of the library proper. This was done to |
| satisfy AppSheet's Trusted Types enforcement, not as a general XSS hardening |
| pass — see Priority Review Area 1. |
| |
| **Production consumers.** The vendored `nv.d3.min.js` is loaded by four live |
| legacy Razor views in `jeenee`, all with a CSP nonce: |
| |
| | View | Line | Surface | |
| |---|---|---| |
| | `V3/MainServer/Views/template/_showTablePartial.cshtml` | 91 | App editor — table/column detail | |
| | `V3/MainServer/Views/Shared/_logDetailsPartial.cshtml` | 76 | Audit-log detail | |
| | `V3/MainServer/Views/Shared/_perfDetailsPartial.cshtml` | 56 | Performance / expression trace detail | |
| | `V3/MainServer/Views/template/commoneditor/appStatsPartial.cshtml` | 102 | App usage statistics | |
| |
| The driver is `jeenee/Nirvana/Scripts/sp-theme/manageGraphs.js` (loaded by |
| `Views/template/AppStats.cshtml:49` and `Views/manage/ViewLog.cshtml:194`). |
| It builds chart data at `manageGraphs.js:72-88` — series `key` comes from |
| `data[i].series` and point `label` from the keys of `data[i].data` — then calls |
| `nv.addGraph(...)` at `manageGraphs.js:114` (and again at `:336` for |
| `showTimeGraph`). Those series keys and point labels derive from **AppSheet app, |
| table, column and view names and from user spreadsheet data**, i.e. from |
| attacker-influenceable strings. |
| |
| ## Prioritization Signals |
| |
| - **1P OSS:** No. Third-party Apache-2.0 OSS maintained as an internal Google |
| fork for AppSheet. |
| - **1P Proprietary Shipped Software:** Yes. `nv.d3.min.js` is minified |
| JavaScript shipped verbatim to AppSheet editor and admin users. |
| - **High-Risk Code Surface:** Yes. The library's core rendering idiom is |
| building HTML strings and assigning them to `innerHTML`, and it bundles a |
| pinned 2023 copy of a security-critical sanitiser (DOMPurify 3.0.5) that |
| receives no upstream updates. |
| - **Perimeter Exposure:** **Yes.** The consuming views are authenticated |
| AppSheet editor / admin pages served on the public Internet. |
| - **Data Sensitivity:** Medium–High. Chart labels are derived from customer |
| app schemas, view names and spreadsheet cell data; the audit-log and |
| app-stats surfaces additionally display end-user identifiers and activity |
| timelines. The library also renders inside pages that carry the operator's |
| authenticated session. |
| - **Untrusted Input Handling:** Yes. Series keys, point labels, axis label |
| text, tooltip header/value strings, and the optional `footer` field all flow |
| from application data into the DOM. |
| - **Business Value:** Renders AppSheet's usage-statistics, audit-log and |
| performance-diagnostics surfaces. These are precisely the surfaces where |
| **one tenant's data is displayed to another principal** — see the |
| cross-tenant framing below. |
| |
| ### Cross-tenant framing (stated honestly) |
| |
| A malicious table name, column name or spreadsheet value primarily renders in |
| **the creator's own editor**, which is self-XSS and low severity on its own. The |
| escalation path is that the same data is rendered on shared and delegated |
| surfaces: |
| |
| - **team/organisation admins** viewing app statistics and audit logs for apps |
| they did not author; |
| - **AppSheet support and operations staff** opening a customer's app stats, |
| audit log or performance trace while investigating a ticket — a |
| cross-tenant, higher-privilege viewer. |
| |
| So the realistic threat is **stored XSS delivered from a low-privilege app |
| creator to a higher-privilege admin or support operator**, not drive-by attack |
| of anonymous users. That is the severity this asset should be triaged at. |
| |
| ## Scanning Harness Prompts |
| |
| 1. **Incomplete DOMPurify coverage in `src/tooltip.js` (highest priority).** |
| The file contains **two** tooltip implementations and the fix was applied to |
| only one: |
| - `nv.tooltip.show()` (the legacy helper) **is** patched: |
| `var safeContent = DOMPurify.sanitize(content, {RETURN_TRUSTED_TYPE: true}); |
| container.innerHTML = safeContent;` (`src/tooltip.js:340-341`, built |
| `nv.d3.js:2339-2340`). |
| - `nv.models.tooltip()` (the "new way", per the file's own header comment) |
| is **not**: its private `getTooltipContainer(newContent)` does a bare |
| `container.node().innerHTML = newContent;` (`src/tooltip.js:167`, built |
| `nv.d3.js:2166`) with **no DOMPurify call anywhere in that code path**. |
| Its default `contentGenerator` builds the markup with D3 `.html()` |
| calls — `.html(headerFormatter(d.value))` (`:83`), |
| `.html(function(p) {return p.key})` (`:101`), |
| `.html(function(p,i) { return valueFormatter(p.value,i) })` (`:104`) — |
| serialises via `table.node().outerHTML`, then **string-concatenates an |
| unescaped footer**: `html += "<div class='footer'>" + d.footer + "</div>"` |
| (`:119-120`). Flag every one of these as an XSS sink. |
| 2. **Reachability of the unsanitised sink.** `nv.models.tooltip` is instantiated |
| by `nv.interactiveGuideline` (`src/interactiveLayer.js:11`, exposed as |
| `layer.tooltip` at `:157`) and invoked as |
| `interactiveLayer.tooltip.position(...).data({value, series})()` by |
| `src/models/lineChart.js:276`, `src/models/stackedAreaChart.js:401` and |
| `src/models/cumulativeLineChart.js:498` — but only when the consumer calls |
| `chart.useInteractiveGuideline(true)`. Scanners should treat this as a live, |
| reachable sink in the shipped bundle and as a public API |
| (`nv.models.tooltip` is exported on `window.nv.models`). |
| 3. **Stale bundled sanitiser.** `src/purify.js` is a frozen copy of **DOMPurify |
| 3.0.5** (`DOMPurify.version = '3.0.5'`, `src/purify.js:319`), released 2023. |
| It is inlined into `nv.d3.js`/`nv.d3.min.js`, so it will never be updated by |
| `npm audit`, Dependabot, or any lockfile-based tooling, and it is invisible to |
| SCA that keys off `package.json`. Check 3.0.5 against subsequently disclosed |
| DOMPurify bypasses and mutation-XSS issues, and flag the absence of any |
| update mechanism as a finding in its own right. |
| 4. **`nv.utils.pjax` — network fetch plus history rewrite.** |
| `src/utils.js:87-105` binds click handlers that call |
| `history.pushState(this.href, …)` and then `d3.html(href, …)`, parsing the |
| response and splicing a selected node into the live DOM via |
| `target.parentNode.replaceChild(...)`. There is no origin or scheme check on |
| `href`. This is a general-purpose fetch-and-inject primitive with no |
| relationship to charting. |
| 5. **SVG identifier and selector construction.** Several models build element |
| IDs and `clip-path` URL references by string concatenation from a chart `id` |
| — e.g. `src/models/historicalBar.js:95,98,102` |
| (`'nv-chart-clip-path-' + id`), `src/models/line.js:99,101` |
| (`'url(#nv-edge-clip-' + scatter.id() + ')'`), and the equivalents in |
| `multiBar.js`, `multiBarTimeSeries.js`, `ohlcBar.js`, `scatter.js`, |
| `lineWithFisheye.js`. Those IDs are also fed back into |
| `wrap.select('#…')` selectors. Verify that no caller can set a chart `id` to |
| an attacker-controlled string and thereby break out of the ID/selector |
| context. |
| 6. **Build-artefact parity.** `nv.d3.js` and `nv.d3.min.js` are hand-committed, |
| not produced by CI. Confirm they are faithful builds of `src/` at every |
| commit; the minified artefact is what actually ships. |
| |
| ## Entry Points and Untrusted Inputs |
| |
| | Entry Point | Type | Trusted? | Validation | |
| |---|---|---|---| |
| | Chart datum `series[].key` | JS data → DOM | No — derives from app/table/column/view names (`manageGraphs.js:76`) | `nv.models.tooltip` default `contentGenerator`: `.html(function(p){return p.key})` — **none**. Legacy `nv.tooltip.show` path: DOMPurify | |
| | Chart datum point `label` / `value` | JS data → DOM | No — derives from user spreadsheet data (`manageGraphs.js:81-82`) | Passed through `valueFormatter` then `.html(...)` — **no escaping** in `nv.models.tooltip` | |
| | `d.value` (tooltip header) | JS data → DOM | No | `.html(headerFormatter(d.value))` — `headerFormatter` defaults to identity, **no escaping** | |
| | `d.footer` | JS data → DOM | No | String-concatenated into `"<div class='footer'>" + d.footer + "</div>"` — **no escaping** | |
| | `chart.tooltipContent(fn)` / `contentGenerator(fn)` | JS API | Caller-supplied | Caller-defined HTML string; the default in e.g. `src/models/multiBarChart.js:28-31` concatenates `key`, `x`, `y` into `<h3>`/`<p>` markup | |
| | `chart.xAxis.axisLabel(text)` | JS API → SVG | No — `options.xAxisName` (`manageGraphs.js:106,108`) | Rendered via D3 `.text()` on an SVG `<text>` node in `src/models/axis.js` (**not** `.html()`), so this is text-context and comparatively safe | |
| | `nv.utils.pjax(links, content)` link `href` | DOM attribute → HTTP | No | **None.** No scheme or origin allowlist before `d3.html(href, …)` | |
| | Chart `id` | JS API → SVG ids and selectors | Caller-supplied | Concatenated into `clipPath` `id` attributes and `#…` selectors without escaping | |
| |
| ## Trust Boundaries and Auth Assumptions |
| |
| - **Authentication:** None at the library layer. All four consuming views are |
| behind AppSheet's authenticated editor/admin session; the library runs with |
| that session's full ambient authority in the browser. |
| - **Authorization:** None at the library layer. The library renders whatever |
| data the hosting page hands it and makes no distinction between |
| first-party-generated labels and customer-authored strings. |
| - **Implicit trust:** The library assumes chart data — series keys, point |
| labels, header values, footers — is trustworthy HTML. In AppSheet that |
| assumption is false: those strings originate from app creators and end-user |
| spreadsheet content. |
| - **Boundary crossings:** |
| 1. App creator / end user authors a table name, column name, view name or |
| spreadsheet cell value. |
| 2. AppSheet server surfaces it in stats / audit-log / performance data. |
| 3. `manageGraphs.js` maps it into `series[].key` and point `label`. |
| 4. nvd3 renders it into the DOM of an **editor, team-admin or support |
| operator's** authenticated page. |
| Step 4 is the trust boundary. The sanitisation gap in `nv.models.tooltip` is |
| exactly at that boundary. |
| |
| ### Mitigating controls (verify, do not assume) |
| |
| - **CSP nonce.** All four views load the bundle with `nonce="@CspNonce"`, |
| indicating a nonce-based CSP. A correct nonce CSP blocks injected |
| `<script>` elements. This limits, but does not eliminate, impact: injected |
| markup, event-handler attributes rejected by CSP still leave overlay/UI-redress |
| and data-exfiltration-via-markup avenues open, and the protection evaporates |
| if `script-src` carries a permissive fallback. |
| - **Trusted Types.** The 2023 fork exists to satisfy TT enforcement. Note that |
| the bare `container.node().innerHTML = newContent` in `getTooltipContainer` |
| would be *blocked* by TT enforcement rather than sanitised — meaning under |
| full TT the unsanitised path fails closed (tooltip breaks) rather than |
| executing. **Confirm whether TT is enforced (not report-only) on each of the |
| four consuming routes**; if it is report-only, the sink is live. |
| - **Current AppSheet usage narrows exposure.** The only nvd3 chart model |
| AppSheet instantiates is `nv.models.multiBarChart` |
| (`manageGraphs.js:46`, `V3/MainServer/Views/template/commoneditor/_perfDisplayPartial.cshtml:148`), |
| whose tooltip routes through the **DOMPurify-sanitised** `nv.tooltip.show` |
| (`src/models/multiBarChart.js:72`). AppSheet does **not** currently call |
| `useInteractiveGuideline(true)`, so the unsanitised `nv.models.tooltip` path |
| is not exercised by today's call sites. It remains shipped, exported, and one |
| line of caller code away from being live — which is why it is still ranked |
| first below. |
| |
| ## Sensitive Data Paths |
| |
| | Data Type | Source | Destination | Protection | |
| |---|---|---|---| |
| | App / table / column / view names | Customer-authored app schema | `series[].key` → tooltip DOM | DOMPurify on the `nv.tooltip.show` path; **none** on the `nv.models.tooltip` path | |
| | Spreadsheet cell values | Customer / end-user data source | Point `label` / `value` → tooltip and axis DOM | Axis labels use `.text()` (safe); tooltip values use `.html()` (unprotected on the `nv.models.tooltip` path) | |
| | End-user activity and identifiers | AppSheet audit log | `_logDetailsPartial.cshtml` charts | Rendered in an admin/support session; same tooltip sinks | |
| | App usage statistics | AppSheet telemetry | `appStatsPartial.cshtml` / `AppStats.cshtml` charts | Same tooltip sinks; cross-tenant viewers possible | |
| | Expression / performance traces | AppSheet app compiler & runtime | `_perfDetailsPartial.cshtml` charts | Same tooltip sinks; traces may embed user formulas and column names | |
| |
| ## Privileged Actions |
| |
| | Action | Location | Guard | |
| |---|---|---| |
| | Assign untrusted string to `innerHTML` | `src/tooltip.js` : `nv.models.tooltip` → `getTooltipContainer` | **None** | |
| | Assign string to `innerHTML` after sanitisation | `src/tooltip.js` : `nv.tooltip.show` | `DOMPurify.sanitize(content, {RETURN_TRUSTED_TYPE: true})` | |
| | Render untrusted values as HTML via D3 | `src/tooltip.js` : `nv.models.tooltip` default `contentGenerator` (`.html()` × 3, plus footer concatenation) | **None** | |
| | Outbound HTTP fetch of a DOM-supplied URL and DOM replacement | `src/utils.js` : `nv.utils.pjax` → `load` (`d3.html`, `replaceChild`) | **None.** No scheme/origin allowlist | |
| | Browser history mutation | `src/utils.js` : `nv.utils.pjax` (`history.pushState`) | **None** | |
| | Bundled HTML sanitiser (security-critical dependency) | `src/purify.js` (DOMPurify 3.0.5), inlined into `nv.d3.js` / `nv.d3.min.js` | Pinned; no update path, invisible to SCA | |
| | SVG `id` / `clip-path` / selector construction from a chart `id` | `src/models/{historicalBar,line,multiBar,multiBarTimeSeries,ohlcBar,scatter,lineWithFisheye,discreteBarChart}.js` | String concatenation, no escaping | |
| |
| ## Priority Review Areas |
| |
| 1. **`nv.models.tooltip` was left out of the DOMPurify fix |
| (`src/tooltip.js` → `getTooltipContainer` and the default |
| `contentGenerator`).** The 2023 patch sanitised the legacy `nv.tooltip.show` |
| helper and stopped there, even though the file's own header comment calls |
| `nv.models.tooltip` "the updated, new way to render tooltips". The result is |
| a shipped, exported tooltip renderer that takes series keys, point values, |
| header values and a footer straight into `.html()` and `innerHTML` with no |
| escaping and no sanitiser. It is invoked in the bundle by |
| `lineChart`/`stackedAreaChart`/`cumulativeLineChart` under |
| `useInteractiveGuideline(true)`. **Accuracy note:** AppSheet's current call |
| sites use only `multiBarChart`, which routes through the *sanitised* helper, |
| so this is a **latent** rather than presently-exercised sink — but it is one |
| `useInteractiveGuideline(true)` away, and the same file already proves the |
| project knows this data is untrusted. Fix by routing |
| `getTooltipContainer` through `DOMPurify.sanitize(..., {RETURN_TRUSTED_TYPE: true})` |
| and replacing the `.html()` calls with `.text()`. |
| 2. **Stale, inlined DOMPurify 3.0.5 with no update path (`src/purify.js`).** A |
| security control frozen at a 2023 release and concatenated into a build |
| artefact is invisible to every dependency scanner AppSheet runs. Establish |
| ownership and an update cadence, check 3.0.5 against subsequently published |
| bypasses, and prefer consuming DOMPurify as a real, version-pinned dependency |
| over an inlined copy. |
| 3. **`nv.utils.pjax` (`src/utils.js`).** A fetch-and-inject plus |
| `history.pushState` primitive with no origin validation, shipped inside a |
| charting library. Determine reachability: no AppSheet code references |
| `nv.utils.pjax`, and it serves no charting purpose. **Recommendation: delete |
| it from the fork** — it is pure attack surface with zero product value. |
| 4. **Cross-tenant exposure of the audit-log, app-stats and performance views.** |
| Confirm which principals can view another tenant's charts (team/org admins, |
| AppSheet support/ops tooling) and treat any tooltip XSS on those routes as |
| privilege-escalating stored XSS rather than self-XSS. |
| 5. **Effective CSP and Trusted Types enforcement mode on the four consuming |
| routes.** Verify `script-src` has no permissive fallback and determine |
| whether `require-trusted-types-for 'script'` is enforcing or report-only. |
| These two controls are what currently bound the impact of every sink above. |
| 6. **SVG identifier and selector construction.** Audit chart `id` propagation |
| into `clipPath` `id` attributes, `url(#…)` references, and `d3.select('#'+id)` |
| selectors across `src/models/` for injection or selector-confusion. |
| 7. **Decade-old upstream base.** The fork is built on nvd3 v1.1.15b (2013) and |
| D3 v3 (`bower.json` pins `d3 ~3.3.5`). Neither receives security |
| maintenance. Evaluate migrating these four legacy views off nvd3 entirely as |
| the durable remediation. |
| |
| ## Out of Scope |
| |
| - **`jeenee/Nirvana/Scripts/app/plugins/nv.d3.indentedTree.js` is NOT produced |
| by this fork.** Its header comment pins it to upstream |
| `https://github.com/novus/nvd3/blob/v1.2.1/src/models/indentedTree.js` — a |
| *different* upstream version from this repository's v1.1.15b base — and it is |
| a separately vendored, standalone file in the `jeenee` repository. It is |
| loaded alongside `nv.d3.min.js` by `_showTablePartial.cshtml:92`, |
| `_logDetailsPartial.cshtml:77` and `_perfDetailsPartial.cshtml:57`, and |
| instantiated as `nv.models.indentedTree()` at `_showTablePartial.cshtml:207` |
| and `_perfDetailsPartial.cshtml:352`. This repository does contain a |
| `src/models/indentedTree.js`, but it is **not** the file that ships. |
| **`nv.d3.indentedTree.js` must be reviewed on the `jeenee` side, not here.** |
| - `deprecated/`, `examples/`, `test/`, `lib/` — sample pages, fixtures and |
| vendored demo dependencies with no production code path. |
| - `src/models/backup/` — superseded model sources retained in-tree; not |
| concatenated into the build. |
| - `GruntFile.js`, `Makefile`, `build.bat`, `.jshintrc` and the Grunt/Babel |
| `devDependencies` — build-time only, not executed in CI for this repository, |
| and producing no automatically served artefact. |
| - `nv.d3.css` / `nv.d3.min.css` — stylesheets with no scripting surface. |
| - D3.js itself. The library requires a global `d3` (v3), supplied separately by |
| AppSheet; it is not vendored in this repository. |
| - Server-side generation and authorisation of the app-stats, audit-log and |
| performance data feeds, `manageGraphs.js`, and the CSP/Trusted Types |
| middleware. All live in the `jeenee` repository and must be reviewed there; |
| they are referenced here only as context and as mitigating controls to be |
| verified. |
