diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md index 6f75b6d3ed..7975865c67 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md @@ -3,31 +3,31 @@ State filter: open Generated: (python port — timestamp not embedded; see file mtime) -- **Alert #704** — `java/path-injection` (high, CodeQL) +- **Alert #706** — `js/incomplete-sanitization` (high, CodeQL) - **Tool:** CodeQL - **State:** open - - **Created:** 2026-08-15T00:32:59Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/704 - - **Location:** projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:216 - - **Message:** This path depends on a user-provided value. + - **Created:** 2026-08-15T20:10:01Z + - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/706 + - **Location:** cui/widgets/app/app.viewmodel.js:88 + - **Message:** This does not escape backslash characters in the input. -- **Alert #564** — `java/xss` (high, CodeQL) +- **Alert #705** — `js/incomplete-sanitization` (high, CodeQL) - **Tool:** CodeQL - **State:** open - - **Created:** 2026-08-03T23:23:01Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/564 - - **Location:** system/release/tomcat/Tomcat/webapps/tomcat-docs/appdev/sample/src/mypackage/Hello.java:78 - - **Message:** Cross-site scripting vulnerability due to a user-provided value. + - **Created:** 2026-08-15T20:10:01Z + - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/705 + - **Location:** cui/widgets/app/app.viewmodel.js:88 + - **Message:** This does not escape backslash characters in the input. -- **Alert #563** — `java/xss` (high, CodeQL) +- **Alert #704** — `java/path-injection` (high, CodeQL) - **Tool:** CodeQL - **State:** open - - **Created:** 2026-08-03T23:23:01Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/563 - - **Location:** system/release/tomcat/Tomcat/webapps/tomcat-docs/appdev/sample/src/mypackage/Hello.java:77 - - **Message:** Cross-site scripting vulnerability due to a user-provided value. + - **Created:** 2026-08-15T00:32:59Z + - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/704 + - **Location:** projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:216 + - **Message:** This path depends on a user-provided value. - **Alert #477** — `java/path-injection` (high, CodeQL) @@ -110,447 +110,6 @@ This path depends on a user-provided value. - **Message:** This path depends on a user-provided value. -- **Alert #398** — `js/functionality-from-untrusted-source` (medium, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/398 - - **Location:** system/UnitTestResources/com/percussion/delivery/bw-corona.html:730 - - **Message:** Script loaded from content delivery network with no integrity check. - - -- **Alert #397** — `js/functionality-from-untrusted-source` (medium, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/397 - - **Location:** system/UnitTestResources/com/percussion/xsl/encoding/Yahoo-EUC-JP.xhtm:46 - - **Message:** Script loaded using unencrypted connection. - - -- **Alert #396** — `js/functionality-from-untrusted-source` (medium, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/396 - - **Location:** system/UnitTestResources/com/percussion/delivery/bw-corona.html:1317 - - **Message:** Script loaded from content delivery network with no integrity check. - - -- **Alert #395** — `js/functionality-from-untrusted-source` (medium, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/395 - - **Location:** system/UnitTestResources/com/percussion/delivery/bw-corona.html:1318 - - **Message:** Script loaded from content delivery network with no integrity check. - - -- **Alert #394** — `js/functionality-from-untrusted-source` (medium, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/394 - - **Location:** system/UnitTestResources/com/percussion/delivery/bw-corona.html:1321 - - **Message:** Script loaded from content delivery network with no integrity check. - - -- **Alert #393** — `js/functionality-from-untrusted-source` (medium, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/393 - - **Location:** system/UnitTestResources/com/percussion/delivery/bw-corona.html:1322 - - **Message:** Script loaded from content delivery network with no integrity check. - - -- **Alert #334** — `js/clear-text-logging` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/334 - - **Location:** modules/perc-qa-automation/frontend/tests/login.spec.js:33 - - **Message:** This logs sensitive data returned by process environment as clear text. - - -- **Alert #246** — `js/incomplete-sanitization` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/246 - - **Location:** system/Docs/Rhythmyx_Publishing_Runtime_Help/dhtml_search.js:57 - - **Message:** This replaces only the first occurrence of "<". - - -- **Alert #245** — `js/incomplete-sanitization` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/245 - - **Location:** system/Docs/Rhythmyx_Publishing_Runtime_Help/dhtml_search.js:57 - - **Message:** This replaces only the first occurrence of ">". - - -- **Alert #244** — `js/incomplete-sanitization` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/244 - - **Location:** system/Docs/Rhythmyx_Publishing_Runtime_Help/dhtml_search.js:57 - - **Message:** This replaces only the first occurrence of '"'. - - -- **Alert #243** — `js/incomplete-sanitization` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/243 - - **Location:** system/Docs/Percussion_Package_Manager_Help/dhtml_search.js:49 - - **Message:** This replaces only the first occurrence of "<". - - -- **Alert #242** — `js/incomplete-sanitization` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/242 - - **Location:** system/Docs/Percussion_Package_Manager_Help/dhtml_search.js:49 - - **Message:** This replaces only the first occurrence of ">". - - -- **Alert #241** — `js/incomplete-sanitization` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/241 - - **Location:** system/Docs/Percussion_Package_Manager_Help/dhtml_search.js:49 - - **Message:** This replaces only the first occurrence of '"'. - - -- **Alert #235** — `js/incomplete-sanitization` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/235 - - **Location:** cui/widgets/app/app.viewmodel.js:87 - - **Message:** This replaces only the first occurrence of /\[\\[\]/. - - -- **Alert #234** — `js/incomplete-sanitization` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/234 - - **Location:** cui/widgets/app/app.viewmodel.js:87 - - **Message:** This replaces only the first occurrence of /\[\\]\]/. - - -- **Alert #206** — `js/unsafe-jquery-plugin` (medium, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/206 - - **Location:** system/Packages/perc.widget.calendar/sys__UserDependency--web_resources/widgets/calendar/js/jquery.qtip.js:256 - - **Message:** Potential XSS vulnerability in the '$.fn.qtip' plugin. - - -- **Alert #181** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/181 - - **Location:** system/UnitTestResources/com/percussion/delivery/bw-corona.html:1310 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #180** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/180 - - **Location:** system/Packages/perc.widgets.image/sys__UserDependency--web_resources/widgets/image/lightbox/lightbox.js:231 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #179** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/179 - - **Location:** system/Packages/perc.widget.form/SupportFile-rx_resources/widgets/form/js/PercFormController.js:1610 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #178** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/178 - - **Location:** system/Packages/perc.widget.form/SupportFile-rx_resources/widgets/form/js/PercFormController.js:1606 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #177** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/177 - - **Location:** system/Packages/perc.widgets.image/sys__UserDependency--rx_resources/widgets/image/js/jquery.imageAssetControl.js:396 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #176** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/176 - - **Location:** system/Packages/perc.widgets.image/SupportFile-rx_resources/widgets/image/js/jquery.imageAssetControl.js:396 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #175** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/175 - - **Location:** system/Packages/perc.widget.socialButtons/sys__UserDependency--rx_resources/widgets/percSocialButtons/js/percSocialButtons.js:132 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #174** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/174 - - **Location:** system/Packages/perc.widget.socialButtons/SupportFile-rx_resources/widgets/percSocialButtons/js/percSocialButtons.js:135 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #173** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/173 - - **Location:** system/Packages/perc.widget.imageSlider/sys__UserDependency--rx_resources/widgets/percImageSlider/js/percImageSlider.js:227 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #172** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/172 - - **Location:** system/Packages/perc.widget.imageSlider/sys__UserDependency--rx_resources/widgets/percImageSlider/js/percImageSlider.js:84 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #171** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/171 - - **Location:** system/Packages/perc.widget.imageSlider/SupportFile-rx_resources/widgets/percImageSlider/js/percImageSlider.js:226 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #170** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/170 - - **Location:** system/Packages/perc.widget.imageSlider/SupportFile-rx_resources/widgets/percImageSlider/js/percImageSlider.js:84 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #169** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/169 - - **Location:** system/Packages/perc.widget.form/SupportFile-rx_resources/widgets/form/js/PercFormView.js:447 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #168** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/168 - - **Location:** system/Packages/perc.widget.directory/sys__UserDependency--web_resources/widgets/directory/js/perc-directory.js:181 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #167** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/167 - - **Location:** system/Packages/perc.widget.directory/sys__UserDependency--web_resources/widgets/directory/js/perc-directory.js:163 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #166** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/166 - - **Location:** system/Packages/perc.widget.blogIndexPage/SupportFile-rx_resources/widgets/blogIndexPage/js/jquery.blogIndexPage.js:50 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #165** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/165 - - **Location:** system/Packages/perc.widget.blogIndexPage/SupportFile-rx_resources/widgets/blogIndexPage/js/jquery.blogIndexPage.js:49 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #164** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/164 - - **Location:** system/Packages/perc.widget.blogIndexPage/SupportFile-rx_resources/widgets/blogIndexPage/js/jquery.blogIndexPage.js:48 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #163** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/163 - - **Location:** system/Packages/perc.gadget.siteframework/sys__UserDependency--cm/gadgets/repository/PercSiteFrameworkGadget/perc_sitewide_framework_gadget.js:120 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. -DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #162** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/162 - - **Location:** system/Packages/perc.PageAutoListWidget/SupportFile-rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:488 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #161** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/161 - - **Location:** system/Packages/perc.PageAutoListWidget/SupportFile-rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:487 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #160** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/160 - - **Location:** system/Packages/perc.PageAutoListWidget/SupportFile-rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:486 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #159** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/159 - - **Location:** system/Packages/perc.PageAutoListWidget/SupportFile-rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:473 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #158** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/158 - - **Location:** system/Packages/perc.PageAutoListWidget/SupportFile-rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:472 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #157** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/157 - - **Location:** system/Packages/perc.PageAutoListWidget/SupportFile-rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:471 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #156** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/156 - - **Location:** system/Packages/perc.PageAutoListWidget/sys__UserDependency--rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:490 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #155** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/155 - - **Location:** system/Packages/perc.PageAutoListWidget/sys__UserDependency--rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:489 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #154** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/154 - - **Location:** system/Packages/perc.PageAutoListWidget/sys__UserDependency--rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:488 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #153** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/153 - - **Location:** system/Packages/perc.PageAutoListWidget/sys__UserDependency--rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:475 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #152** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/152 - - **Location:** system/Packages/perc.PageAutoListWidget/sys__UserDependency--rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:474 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #151** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/151 - - **Location:** system/Packages/perc.PageAutoListWidget/sys__UserDependency--rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:473 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - - **Alert #143** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open @@ -676,30 +235,3 @@ DOM text is reinterpreted as HTML without escaping meta-characters. - **Location:** delivery/common/js/views/PercArchiveListView.js:131 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - -- **Alert #90** — `js/html-constructed-from-input` (medium, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/90 - - **Location:** system/Packages/perc.widget.calendar/sys__UserDependency--web_resources/widgets/calendar/js/jquery.qtip.js:1327 - - **Message:** This HTML construction which depends on library input might later allow cross-site scripting. - - -- **Alert #89** — `js/html-constructed-from-input` (medium, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/89 - - **Location:** system/Packages/perc.CategoryDropDownControl/SupportFile-rx_resources/widgets/categoryDropDown/js/categoryDropdown.js:255 - - **Message:** This HTML construction which depends on library input might later allow cross-site scripting. - - -- **Alert #88** — `js/html-constructed-from-input` (medium, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/88 - - **Location:** system/Packages/perc.CategoryDropDownControl/SupportFile-rx_resources/widgets/categoryDropDown/js/categoryDropdown.js:255 - - **Message:** This HTML construction which depends on library input might later allow cross-site scripting. - diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md index 1eaccd4e61..4b7cf1e816 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md @@ -1,34 +1,32 @@ # CodeQL Critical+High Clusters on 8.1.x (main) -Generated: 2026-08-15T21:10:13Z +Generated: 2026-08-15T21:14:20Z Source: docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md ## Summary -- Total open alerts: 75 -- Critical+High open: 65 -- Cluster count: 5 +- Total open alerts: 25 +- Critical+High open: 25 +- Cluster count: 3 ## Cluster Map | Rule | Severity | Count | Reference 004 PR | Notes | |---|---|---|---|---| -| `js/xss-through-dom` | high | 45 | TBD | | -| `java/path-injection` | high | 9 | PR #1365 + #1362 + #1361 | 8.1.x: this PR | -| `js/incomplete-sanitization` | high | 8 | TBD | 8.1.x: PR #57 (6 path-ignore + 2 code fix) | -| `java/xss` | high | 2 | PR #1348 + #1344 + #1367 | 8.1.x: PR #55 (Tomcat sample) | -| `js/clear-text-logging` | high | 1 | TBD | 8.1.x: PR #56 | +| `js/xss-through-dom` | high | 14 | TBD | 8.1.x: post-merge residual | +| `java/path-injection` | high | 9 | PR #1365 + #1362 + #1361 | 8.1.x: post-merge residual | +| `js/incomplete-sanitization` | high | 2 | TBD | 8.1.x: post-merge residual | ## Per-Cluster Detail -### `js/xss-through-dom` (45 alerts) +### `js/xss-through-dom` (14 alerts) -- Alert #181 — `system/UnitTestResources/com/percussion/delivery/bw-corona.html:1310` -- Alert #180 — `system/Packages/perc.widgets.image/sys__UserDependency--web_resources/widgets/image/lightbox/lightbox.js:231` -- Alert #179 — `system/Packages/perc.widget.form/SupportFile-rx_resources/widgets/form/js/PercFormController.js:1610` -- Alert #178 — `system/Packages/perc.widget.form/SupportFile-rx_resources/widgets/form/js/PercFormController.js:1606` -- Alert #177 — `system/Packages/perc.widgets.image/sys__UserDependency--rx_resources/widgets/image/js/jquery.imageAssetControl.js:396` -- ... and 40 more +- Alert #143 — `delivery/common/js/views/PercTagListView.js:115` +- Alert #142 — `delivery/common/js/views/PercRssView.js:144` +- Alert #141 — `delivery/common/js/views/PercRssView.js:140` +- Alert #140 — `delivery/common/js/views/PercRssView.js:64` +- Alert #139 — `delivery/common/js/views/PercRegistrationView.js:260` +- ... and 9 more ### `java/path-injection` (9 alerts) @@ -39,20 +37,7 @@ Source: docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md - Alert #467 — `projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:182` - ... and 4 more -### `js/incomplete-sanitization` (8 alerts) +### `js/incomplete-sanitization` (2 alerts) -- Alert #246 — `system/Docs/Rhythmyx_Publishing_Runtime_Help/dhtml_search.js:57` -- Alert #245 — `system/Docs/Rhythmyx_Publishing_Runtime_Help/dhtml_search.js:57` -- Alert #244 — `system/Docs/Rhythmyx_Publishing_Runtime_Help/dhtml_search.js:57` -- Alert #243 — `system/Docs/Percussion_Package_Manager_Help/dhtml_search.js:49` -- Alert #242 — `system/Docs/Percussion_Package_Manager_Help/dhtml_search.js:49` -- ... and 3 more - -### `java/xss` (2 alerts) - -- Alert #564 — `system/release/tomcat/Tomcat/webapps/tomcat-docs/appdev/sample/src/mypackage/Hello.java:78` -- Alert #563 — `system/release/tomcat/Tomcat/webapps/tomcat-docs/appdev/sample/src/mypackage/Hello.java:77` - -### `js/clear-text-logging` (1 alerts) - -- Alert #334 — `modules/perc-qa-automation/frontend/tests/login.spec.js:33` +- Alert #706 — `cui/widgets/app/app.viewmodel.js:88` +- Alert #705 — `cui/widgets/app/app.viewmodel.js:88` diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/triage.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/triage.md index 1a338230e6..f543e9479a 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/triage.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/triage.md @@ -2,91 +2,41 @@ Every open Critical/High alert gets exactly one row here. The pipeline gates (`scripts/verify-triage-inventory.py`, `scripts/verify-valid-fixes.py`) read this file. -Generated: 2026-08-15T21:10:12Z +Generated: 2026-08-15T21:14:20Z Source: docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md ## Summary -- Total open alerts: 75 -- false-positive: 7 -- fix: 68 +- Total open alerts: 25 +- false-positive: 9 +- fix: 16 Schema (per spec 004 C1): | # | alert_id | rule_id | severity | file_path | module_owner | disposition (candidate) | target_action | target_milestone | linked_pr | notes | |---|----------|---------|----------|-----------|--------------|-------------------------|---------------|------------------|-----------|-------| -| 1 | 704 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:216 | projects/sitemanage | fix | code fix required | TBD | | suppressions.md lists this alert under projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (linked_pr=this PR); path-ignore not yet applied | -| 2 | 564 | java/xss | high | system/release/tomcat/Tomcat/webapps/tomcat-docs/appdev/sample/src/mypackage/Hello.java:78 | system | fix | code fix required | TBD | | suppressions.md lists this alert under .github/codeql/codeql-config.yml (linked_pr=this PR); path-ignore not yet applied | -| 3 | 563 | java/xss | high | system/release/tomcat/Tomcat/webapps/tomcat-docs/appdev/sample/src/mypackage/Hello.java:77 | system | fix | code fix required | TBD | | suppressions.md lists this alert under .github/codeql/codeql-config.yml (linked_pr=this PR); path-ignore not yet applied | -| 4 | 477 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:519 | projects/sitemanage | fix | code fix required | TBD | | suppressions.md lists this alert under projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (linked_pr=this PR); path-ignore not yet applied | -| 5 | 476 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:518 | projects/sitemanage | fix | code fix required | TBD | | suppressions.md lists this alert under projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (linked_pr=this PR); path-ignore not yet applied | -| 6 | 474 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:403 | projects/sitemanage | fix | code fix required | TBD | | suppressions.md lists this alert under projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (linked_pr=this PR); path-ignore not yet applied | -| 7 | 467 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:182 | projects/sitemanage | fix | code fix required | TBD | | suppressions.md lists this alert under projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (linked_pr=this PR); path-ignore not yet applied | -| 8 | 457 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java:451 | projects/sitemanage | fix | code fix required | TBD | | suppressions.md lists this alert under projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java (linked_pr=this PR); path-ignore not yet applied | -| 9 | 456 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java:419 | projects/sitemanage | fix | code fix required | TBD | | suppressions.md lists this alert under projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java (linked_pr=this PR); path-ignore not yet applied | -| 10 | 455 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java:364 | projects/sitemanage | fix | code fix required | TBD | | suppressions.md lists this alert under projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java (linked_pr=this PR); path-ignore not yet applied | -| 11 | 454 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/helpers/impl/PSImportThemeHelper.java:257 | projects/sitemanage | fix | code fix required | TBD | | suppressions.md lists this alert under projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/helpers/impl/PSImportThemeHelper.java (linked_pr=this PR); path-ignore not yet applied | -| 12 | 398 | js/functionality-from-untrusted-source | medium | system/UnitTestResources/com/percussion/delivery/bw-corona.html:730 | system | fix | code fix required | TBD | | | -| 13 | 397 | js/functionality-from-untrusted-source | medium | system/UnitTestResources/com/percussion/xsl/encoding/Yahoo-EUC-JP.xhtm:46 | system | fix | code fix required | TBD | | | -| 14 | 396 | js/functionality-from-untrusted-source | medium | system/UnitTestResources/com/percussion/delivery/bw-corona.html:1317 | system | fix | code fix required | TBD | | | -| 15 | 395 | js/functionality-from-untrusted-source | medium | system/UnitTestResources/com/percussion/delivery/bw-corona.html:1318 | system | fix | code fix required | TBD | | | -| 16 | 394 | js/functionality-from-untrusted-source | medium | system/UnitTestResources/com/percussion/delivery/bw-corona.html:1321 | system | fix | code fix required | TBD | | | -| 17 | 393 | js/functionality-from-untrusted-source | medium | system/UnitTestResources/com/percussion/delivery/bw-corona.html:1322 | system | fix | code fix required | TBD | | | -| 18 | 334 | js/clear-text-logging | high | modules/perc-qa-automation/frontend/tests/login.spec.js:33 | modules/perc-qa-automation | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore modules/perc-qa-automation/frontend/tests/** (#justification: Playwright QA tests log env-derived values for debug; production runtime not affected) @ line 30 | -| 19 | 246 | js/incomplete-sanitization | high | system/Docs/Rhythmyx_Publishing_Runtime_Help/dhtml_search.js:57 | system | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore system/Docs/** (#justification: vendored AuthorIT-generated docs JS; not regenerated from source) @ line 42 | -| 20 | 245 | js/incomplete-sanitization | high | system/Docs/Rhythmyx_Publishing_Runtime_Help/dhtml_search.js:57 | system | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore system/Docs/** (#justification: vendored AuthorIT-generated docs JS; not regenerated from source) @ line 42 | -| 21 | 244 | js/incomplete-sanitization | high | system/Docs/Rhythmyx_Publishing_Runtime_Help/dhtml_search.js:57 | system | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore system/Docs/** (#justification: vendored AuthorIT-generated docs JS; not regenerated from source) @ line 42 | -| 22 | 243 | js/incomplete-sanitization | high | system/Docs/Percussion_Package_Manager_Help/dhtml_search.js:49 | system | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore system/Docs/** (#justification: vendored AuthorIT-generated docs JS; not regenerated from source) @ line 42 | -| 23 | 242 | js/incomplete-sanitization | high | system/Docs/Percussion_Package_Manager_Help/dhtml_search.js:49 | system | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore system/Docs/** (#justification: vendored AuthorIT-generated docs JS; not regenerated from source) @ line 42 | -| 24 | 241 | js/incomplete-sanitization | high | system/Docs/Percussion_Package_Manager_Help/dhtml_search.js:49 | system | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore system/Docs/** (#justification: vendored AuthorIT-generated docs JS; not regenerated from source) @ line 42 | -| 25 | 235 | js/incomplete-sanitization | high | cui/widgets/app/app.viewmodel.js:87 | cui | fix | code fix required | TBD | | suppressions.md lists this alert under cui/widgets/app/app.viewmodel.js (linked_pr=this PR); path-ignore not yet applied | -| 26 | 234 | js/incomplete-sanitization | high | cui/widgets/app/app.viewmodel.js:87 | cui | fix | code fix required | TBD | | suppressions.md lists this alert under cui/widgets/app/app.viewmodel.js (linked_pr=this PR); path-ignore not yet applied | -| 27 | 206 | js/unsafe-jquery-plugin | medium | system/Packages/perc.widget.calendar/sys__UserDependency--web_resources/widgets/calendar/js/jquery.qtip.js:256 | system | fix | code fix required | TBD | | | -| 28 | 181 | js/xss-through-dom | high | system/UnitTestResources/com/percussion/delivery/bw-corona.html:1310 | system | fix | code fix required | TBD | | | -| 29 | 180 | js/xss-through-dom | high | system/Packages/perc.widgets.image/sys__UserDependency--web_resources/widgets/image/lightbox/lightbox.js:231 | system | fix | code fix required | TBD | | | -| 30 | 179 | js/xss-through-dom | high | system/Packages/perc.widget.form/SupportFile-rx_resources/widgets/form/js/PercFormController.js:1610 | system | fix | code fix required | TBD | | | -| 31 | 178 | js/xss-through-dom | high | system/Packages/perc.widget.form/SupportFile-rx_resources/widgets/form/js/PercFormController.js:1606 | system | fix | code fix required | TBD | | | -| 32 | 177 | js/xss-through-dom | high | system/Packages/perc.widgets.image/sys__UserDependency--rx_resources/widgets/image/js/jquery.imageAssetControl.js:396 | system | fix | code fix required | TBD | | | -| 33 | 176 | js/xss-through-dom | high | system/Packages/perc.widgets.image/SupportFile-rx_resources/widgets/image/js/jquery.imageAssetControl.js:396 | system | fix | code fix required | TBD | | | -| 34 | 175 | js/xss-through-dom | high | system/Packages/perc.widget.socialButtons/sys__UserDependency--rx_resources/widgets/percSocialButtons/js/percSocialButtons.js:132 | system | fix | code fix required | TBD | | | -| 35 | 174 | js/xss-through-dom | high | system/Packages/perc.widget.socialButtons/SupportFile-rx_resources/widgets/percSocialButtons/js/percSocialButtons.js:135 | system | fix | code fix required | TBD | | | -| 36 | 173 | js/xss-through-dom | high | system/Packages/perc.widget.imageSlider/sys__UserDependency--rx_resources/widgets/percImageSlider/js/percImageSlider.js:227 | system | fix | code fix required | TBD | | | -| 37 | 172 | js/xss-through-dom | high | system/Packages/perc.widget.imageSlider/sys__UserDependency--rx_resources/widgets/percImageSlider/js/percImageSlider.js:84 | system | fix | code fix required | TBD | | | -| 38 | 171 | js/xss-through-dom | high | system/Packages/perc.widget.imageSlider/SupportFile-rx_resources/widgets/percImageSlider/js/percImageSlider.js:226 | system | fix | code fix required | TBD | | | -| 39 | 170 | js/xss-through-dom | high | system/Packages/perc.widget.imageSlider/SupportFile-rx_resources/widgets/percImageSlider/js/percImageSlider.js:84 | system | fix | code fix required | TBD | | | -| 40 | 169 | js/xss-through-dom | high | system/Packages/perc.widget.form/SupportFile-rx_resources/widgets/form/js/PercFormView.js:447 | system | fix | code fix required | TBD | | | -| 41 | 168 | js/xss-through-dom | high | system/Packages/perc.widget.directory/sys__UserDependency--web_resources/widgets/directory/js/perc-directory.js:181 | system | fix | code fix required | TBD | | | -| 42 | 167 | js/xss-through-dom | high | system/Packages/perc.widget.directory/sys__UserDependency--web_resources/widgets/directory/js/perc-directory.js:163 | system | fix | code fix required | TBD | | | -| 43 | 166 | js/xss-through-dom | high | system/Packages/perc.widget.blogIndexPage/SupportFile-rx_resources/widgets/blogIndexPage/js/jquery.blogIndexPage.js:50 | system | fix | code fix required | TBD | | | -| 44 | 165 | js/xss-through-dom | high | system/Packages/perc.widget.blogIndexPage/SupportFile-rx_resources/widgets/blogIndexPage/js/jquery.blogIndexPage.js:49 | system | fix | code fix required | TBD | | | -| 45 | 164 | js/xss-through-dom | high | system/Packages/perc.widget.blogIndexPage/SupportFile-rx_resources/widgets/blogIndexPage/js/jquery.blogIndexPage.js:48 | system | fix | code fix required | TBD | | | -| 46 | 163 | js/xss-through-dom | high | system/Packages/perc.gadget.siteframework/sys__UserDependency--cm/gadgets/repository/PercSiteFrameworkGadget/perc_sitewide_framework_gadget.js:120 | system | fix | code fix required | TBD | | | -| 47 | 162 | js/xss-through-dom | high | system/Packages/perc.PageAutoListWidget/SupportFile-rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:488 | system | fix | code fix required | TBD | | | -| 48 | 161 | js/xss-through-dom | high | system/Packages/perc.PageAutoListWidget/SupportFile-rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:487 | system | fix | code fix required | TBD | | | -| 49 | 160 | js/xss-through-dom | high | system/Packages/perc.PageAutoListWidget/SupportFile-rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:486 | system | fix | code fix required | TBD | | | -| 50 | 159 | js/xss-through-dom | high | system/Packages/perc.PageAutoListWidget/SupportFile-rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:473 | system | fix | code fix required | TBD | | | -| 51 | 158 | js/xss-through-dom | high | system/Packages/perc.PageAutoListWidget/SupportFile-rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:472 | system | fix | code fix required | TBD | | | -| 52 | 157 | js/xss-through-dom | high | system/Packages/perc.PageAutoListWidget/SupportFile-rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:471 | system | fix | code fix required | TBD | | | -| 53 | 156 | js/xss-through-dom | high | system/Packages/perc.PageAutoListWidget/sys__UserDependency--rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:490 | system | fix | code fix required | TBD | | | -| 54 | 155 | js/xss-through-dom | high | system/Packages/perc.PageAutoListWidget/sys__UserDependency--rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:489 | system | fix | code fix required | TBD | | | -| 55 | 154 | js/xss-through-dom | high | system/Packages/perc.PageAutoListWidget/sys__UserDependency--rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:488 | system | fix | code fix required | TBD | | | -| 56 | 153 | js/xss-through-dom | high | system/Packages/perc.PageAutoListWidget/sys__UserDependency--rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:475 | system | fix | code fix required | TBD | | | -| 57 | 152 | js/xss-through-dom | high | system/Packages/perc.PageAutoListWidget/sys__UserDependency--rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:474 | system | fix | code fix required | TBD | | | -| 58 | 151 | js/xss-through-dom | high | system/Packages/perc.PageAutoListWidget/sys__UserDependency--rx_resources/widgets/pageAutoList/js/jquery.pageAutoList.js:473 | system | fix | code fix required | TBD | | | -| 59 | 143 | js/xss-through-dom | high | delivery/common/js/views/PercTagListView.js:115 | delivery | fix | code fix required | TBD | | | -| 60 | 142 | js/xss-through-dom | high | delivery/common/js/views/PercRssView.js:144 | delivery | fix | code fix required | TBD | | | -| 61 | 141 | js/xss-through-dom | high | delivery/common/js/views/PercRssView.js:140 | delivery | fix | code fix required | TBD | | | -| 62 | 140 | js/xss-through-dom | high | delivery/common/js/views/PercRssView.js:64 | delivery | fix | code fix required | TBD | | | -| 63 | 139 | js/xss-through-dom | high | delivery/common/js/views/PercRegistrationView.js:260 | delivery | fix | code fix required | TBD | | | -| 64 | 138 | js/xss-through-dom | high | delivery/common/js/views/PercRegistrationView.js:72 | delivery | fix | code fix required | TBD | | | -| 65 | 137 | js/xss-through-dom | high | delivery/common/js/views/PercMostReadBlogPostsView.js:105 | delivery | fix | code fix required | TBD | | | -| 66 | 136 | js/xss-through-dom | high | delivery/common/js/views/PercMostReadBlogPostsView.js:70 | delivery | fix | code fix required | TBD | | | -| 67 | 135 | js/xss-through-dom | high | delivery/common/js/views/PercCategoryListView.js:192 | delivery | fix | code fix required | TBD | | | -| 68 | 134 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:279 | delivery | fix | code fix required | TBD | | | -| 69 | 133 | js/xss-through-dom | high | delivery/common/js/views/PercBlogPostView.js:153 | delivery | fix | code fix required | TBD | | | -| 70 | 132 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:191 | delivery | fix | code fix required | TBD | | | -| 71 | 131 | js/xss-through-dom | high | delivery/common/js/views/PercBlogPostView.js:144 | delivery | fix | code fix required | TBD | | | -| 72 | 130 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:131 | delivery | fix | code fix required | TBD | | | -| 73 | 90 | js/html-constructed-from-input | medium | system/Packages/perc.widget.calendar/sys__UserDependency--web_resources/widgets/calendar/js/jquery.qtip.js:1327 | system | fix | code fix required | TBD | | | -| 74 | 89 | js/html-constructed-from-input | medium | system/Packages/perc.CategoryDropDownControl/SupportFile-rx_resources/widgets/categoryDropDown/js/categoryDropdown.js:255 | system | fix | code fix required | TBD | | | -| 75 | 88 | js/html-constructed-from-input | medium | system/Packages/perc.CategoryDropDownControl/SupportFile-rx_resources/widgets/categoryDropDown/js/categoryDropdown.js:255 | system | fix | code fix required | TBD | | | +| 1 | 706 | js/incomplete-sanitization | high | cui/widgets/app/app.viewmodel.js:88 | cui | fix | code fix required | TBD | | | +| 2 | 705 | js/incomplete-sanitization | high | cui/widgets/app/app.viewmodel.js:88 | cui | fix | code fix required | TBD | | | +| 3 | 704 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:216 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (#justification: runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual) @ line 77 | +| 4 | 477 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:519 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (#justification: runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual) @ line 77 | +| 5 | 476 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:518 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (#justification: runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual) @ line 77 | +| 6 | 474 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:403 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (#justification: runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual) @ line 77 | +| 7 | 467 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:182 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (#justification: runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual) @ line 77 | +| 8 | 457 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java:451 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java (#see config) @ line 78 | +| 9 | 456 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java:419 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java (#see config) @ line 78 | +| 10 | 455 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java:364 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java (#see config) @ line 78 | +| 11 | 454 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/helpers/impl/PSImportThemeHelper.java:257 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/helpers/impl/PSImportThemeHelper.java (#see config) @ line 79 | +| 12 | 143 | js/xss-through-dom | high | delivery/common/js/views/PercTagListView.js:115 | delivery | fix | code fix required | TBD | | | +| 13 | 142 | js/xss-through-dom | high | delivery/common/js/views/PercRssView.js:144 | delivery | fix | code fix required | TBD | | | +| 14 | 141 | js/xss-through-dom | high | delivery/common/js/views/PercRssView.js:140 | delivery | fix | code fix required | TBD | | | +| 15 | 140 | js/xss-through-dom | high | delivery/common/js/views/PercRssView.js:64 | delivery | fix | code fix required | TBD | | | +| 16 | 139 | js/xss-through-dom | high | delivery/common/js/views/PercRegistrationView.js:260 | delivery | fix | code fix required | TBD | | | +| 17 | 138 | js/xss-through-dom | high | delivery/common/js/views/PercRegistrationView.js:72 | delivery | fix | code fix required | TBD | | | +| 18 | 137 | js/xss-through-dom | high | delivery/common/js/views/PercMostReadBlogPostsView.js:105 | delivery | fix | code fix required | TBD | | | +| 19 | 136 | js/xss-through-dom | high | delivery/common/js/views/PercMostReadBlogPostsView.js:70 | delivery | fix | code fix required | TBD | | | +| 20 | 135 | js/xss-through-dom | high | delivery/common/js/views/PercCategoryListView.js:192 | delivery | fix | code fix required | TBD | | | +| 21 | 134 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:279 | delivery | fix | code fix required | TBD | | | +| 22 | 133 | js/xss-through-dom | high | delivery/common/js/views/PercBlogPostView.js:153 | delivery | fix | code fix required | TBD | | | +| 23 | 132 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:191 | delivery | fix | code fix required | TBD | | | +| 24 | 131 | js/xss-through-dom | high | delivery/common/js/views/PercBlogPostView.js:144 | delivery | fix | code fix required | TBD | | | +| 25 | 130 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:131 | delivery | fix | code fix required | TBD | | |