security(finicity): JSON-encode user-controlled values in WebView script

[cursor]

Vulnerability summary

Finicity Connect's web renderer interpolated user-influenced uri, overlay, position, and widgetId values directly into generated JavaScript. Attacker-controlled bindings could break out of string literals and execute arbitrary code inside the Finicity WebView.

Affected location

• modules/ensemble/lib/widget/fintech/finicityconnect/web/finicityconnectstate.dart
• New helper: modules/ensemble/lib/widget/fintech/finicity_connect_script.dart

Security impact

High — An external attacker who can influence Finicity widget configuration can inject JavaScript in the WebView context and forge Finicity callback messages, triggering downstream YAML actions such as onSuccess with attacker-controlled event data.

Attack path

1. Attacker controls input bound to uri, overlay, or position (via deeplink args, API response, or other user input).
2. Finicity web renderer embeds the value in a JS string literal without escaping.
3. Payload breaks out of the literal (e.g. "); alert(1);//) and runs in the WebView.
4. Attacker can call handleMessage(...) to trigger financial flow callbacks.

Fix approach

• Extract script generation into buildFinicityConnectInstantiateScript().
• Embed all externally influenced string values via jsonEncode().

Tests

• Added modules/ensemble/test/finicity_connect_script_test.dart