From 6b32f79677cc436e1a0a7e6feb83666c1130bcb4 Mon Sep 17 00:00:00 2001 From: Nate Chadwick <263952448+natechadwick-intsof@users.noreply.github.com> Date: Sat, 15 Aug 2026 16:18:59 -0400 Subject: [PATCH] codeql: path-ignore vendored widget packages and UnitTestResources MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes 32 of 45 js/xss-through-dom alerts (and 6 medium js/functionality-from-untrusted-source alerts) via path-ignore: - system/Packages/perc.*/** — 31 xss-through-dom alerts in vendored CMS widget packages (perc.widget.*, perc.widgets.*, perc.PageAutoListWidget, perc.gadget.*, etc.). These are packaging mirror trees identical in shape to cui/components/** (already in the config); widget JS ships prebuilt and is not regenerated from Maven source. - system/UnitTestResources/** — 1 xss-through-dom + 6 medium functionality-from-untrusted-source alerts in Maven test resources at the system module top-level. Existing **/src/test/** doesn't reach this path. First-party delivery views (delivery/common/js/views/Perc*View.js, 14 xss-through-dom alerts) and bw-corona.html remain in the js/xss-through-dom cluster for the follow-up code-fix PR. clusters.md row updated. suppressions.md needs no new rows because each path-level entry above already documents the global path-ignore in codeql-config.yml. Verification: - python3 scripts/verify-triage-inventory.py PASS (10 fp, 69 fix) - python3 scripts/verify-valid-fixes.py PASS JDK 1.8.0 compatible. No CHANGELOG.md entry per AGENTS.md. # Please enter the commit message for your changes. Lines starting # with '#' will be kept; you may remove them yourself if you want to. # An empty message aborts the commit. # # interactive rebase in progress; onto d16a655bee # Last command done (1 command done): # pick 5ee3b22bd6 codeql: path-ignore vendored widget packages and UnitTestResources # No commands remaining. # You are currently rebasing branch 'codeql/js-xss-through-dom-vendored' on 'd16a655bee'. # # Changes to be committed: # modified: .github/codeql/codeql-config.yml # # Untracked files: # docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md.stale.md # scripts/__pycache__/ # --- .github/codeql/codeql-config.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml index 9b70f48b5b..9c8bdad4a4 100644 --- a/.github/codeql/codeql-config.yml +++ b/.github/codeql/codeql-config.yml @@ -40,6 +40,18 @@ paths-ignore: # regex escaping that CodeQL flags as js/incomplete-sanitization. # justification: vendored AuthorIT-generated docs JS; not regenerated from source - "system/Docs/**" + # CMS widget packaging mirror (system/Packages/perc.*/**): widget packages + # are installed into a CMS server as prebuilt bundles, not regenerated from + # Maven source. JS in these trees carries DOM-XSS sinks that predate the + # 8.1.x security baseline; fixing them in this branch would diverge from + # the upstream package source. + # justification: packaging mirror tree identical to cui/components/**; widgets are installed CMS packages, not built source + - "system/Packages/perc.*/**" + # Maven test resources directory at the system module level (not under src/test/, + # so the existing **/src/test/** and **/src/test/resources/** patterns miss it). + # Bundles delivery HTML fixtures used by JUnit 4 tests in system/src/test/java. + # justification: Maven test resources at the system module top-level; not generated from source + - "system/UnitTestResources/**" # sys_resources vendored JS files (dojo, trinidad, jQuery, mobile preview, etc.) - "system/cms/content/applications/sys_resources/ApplicationFiles/**" # modules upload-time vendored JS (tinymce plugins, codemirror, etc.)