dsh-raw-html-v2

When the shield badge is switched on (one click on #vcp-trusted-toggle, persisted in localStorage), any event-handler source and card <script> carried by an assistant message is activated inside the DSH app origin. Chat content that merely quotes untrusted material (web page, file, injected text) then runs with the page's privileges: it can read the DOM/session state and call the host RPC surface exposed to this page (create-style, update-style, delete-style, add-fonts-root, open-style-folder, ai-generate), i.e. attacker-influenced code execution in the application origin.

Whatever the host serves at that fixed same-origin path is compiled and run with full page privileges, with no hash or integrity check and outside CSP script-src protections that normally apply to <script src>. The engine file (assets/vcp-engine-v1.js) was not part of the harvested sources, so the actual sanitising/scoping code that filters card HTML cannot be audited from this review.

One click on model-authored HTML (a button can be styled to look like anything, or cover the card) composes and submits an arbitrary message under the user's identity without confirmation. That message is a fresh model instruction, so it amplifies prompt injection into host RPC actions and file/style mutations. It works even with trusted mode off.

Every attribute that is not explicitly special-cased is copied verbatim into the React element. The iframe guard only inspects src, so a card can pair a valid https src with an unfiltered srcdoc (same-origin markup/script if the browser prefers it), and behavioural/URL-bearing attributes such as form/frame action, formaction or name are never validated - a script-free bypass route around the intended 'no script unless trusted' policy.

The exported .html file keeps the model-authored script code in a standalone document. Opened later from the local filesystem (file://) it executes that code with local-file read access, long after the chat is over.