codeql: path-ignore vendored widget packages and UnitTestResources - #59
Merged
Merged
Conversation
Closes 32 of 45 js/xss-through-dom alerts (and 6 medium
js/functionality-from-untrusted-source alerts) via path-ignore:
- system/Packages/perc.*/** — 31 xss-through-dom alerts in vendored CMS
widget packages (perc.widget.*, perc.widgets.*, perc.PageAutoListWidget,
perc.gadget.*, etc.). These are packaging mirror trees identical in
shape to cui/components/** (already in the config); widget JS ships
prebuilt and is not regenerated from Maven source.
- system/UnitTestResources/** — 1 xss-through-dom + 6 medium
functionality-from-untrusted-source alerts in Maven test resources at
the system module top-level. Existing **/src/test/** doesn't reach
this path.
First-party delivery views (delivery/common/js/views/Perc*View.js, 14
xss-through-dom alerts) and bw-corona.html remain in the
js/xss-through-dom cluster for the follow-up code-fix PR.
clusters.md row updated. suppressions.md needs no new rows because each
path-level entry above already documents the global path-ignore in
codeql-config.yml.
Verification:
- python3 scripts/verify-triage-inventory.py PASS (10 fp, 69 fix)
- python3 scripts/verify-valid-fixes.py PASS
JDK 1.8.0 compatible. No CHANGELOG.md entry per AGENTS.md.
# Please enter the commit message for your changes. Lines starting
# with '#' will be kept; you may remove them yourself if you want to.
# An empty message aborts the commit.
#
# interactive rebase in progress; onto d16a655
# Last command done (1 command done):
# pick 5ee3b22 codeql: path-ignore vendored widget packages and UnitTestResources
# No commands remaining.
# You are currently rebasing branch 'codeql/js-xss-through-dom-vendored' on 'd16a655bee'.
#
# Changes to be committed:
# modified: .github/codeql/codeql-config.yml
#
# Untracked files:
# docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md.stale.md
# scripts/__pycache__/
#
natechadwick-intsof
force-pushed
the
codeql/js-xss-through-dom-vendored
branch
from
August 15, 2026 21:12
5ee3b22 to
6b32f79
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes 32 of 45 js/xss-through-dom alerts (plus 6 medium
js/functionality-from-untrusted-sourcealerts) via path-ignoreadditions in
.github/codeql/codeql-config.yml:**
system/Packages/perc.*/**— 31 js/xss-through-dom alerts invendored CMS widget packages (
perc.widget.*,perc.widgets.*,perc.PageAutoListWidget,perc.gadget.*, etc.). These arepackaging mirror trees identical in shape to the existing
cui/components/**exclusion; widget JS ships prebuilt and is notregenerated from Maven source.
**
system/UnitTestResources/**— 1 js/xss-through-dom alert and 6js/functionality-from-untrusted-sourcealerts in Maven testresources at the system module top-level. The existing
**/src/test/**doesn't reach this path (top-levelUnitTestResourcesnot
src/test/).The remaining 13 js/xss-through-dom alerts are in
delivery/common/js/views/Perc*View.js(first-party delivery views)and will be addressed in a follow-up code-fix PR.
Validation
python3 scripts/verify-triage-inventory.py— PASS (79 rows; 10 false-positive, 69 fix)python3 scripts/verify-valid-fixes.py— PASSmvn spotless:check— no source-file violationsJDK 1.8.0 compatible. No CHANGELOG.md entry per AGENTS.md.