docs(codeql): track 9 residual js/xss-through-dom alerts in suppressions.md - #63
Merged
Merged
Conversation
…ons.md After PR #62 merged, a new CodeQL scan surfaced 9 js/xss-through-dom alerts in delivery/common/js/views/. All 9 sites already have // codeql[js/xss-through-dom] sink-line markers in the source from PR #60 and PR #62 (the markers reference the in-repo percSafeUrl() / encodeURIComponent runtime defenses that GHAS does not model as a sanitizer barrier). suppressions.md gets one row per alert so verify-suppressions.py recognizes the eventual dismissal. clusters.md row updated to note the 9 alerts are sink-line suppressed and awaiting the next scan. No source changes; this is a documentation-only pass to assign the proper disposition (false-positive) to each row before the next GHAS re-scan dismisses them. Verification: - python3 scripts/verify-suppressions.py PASS - python3 scripts/verify-triage-inventory.py PASS (9 of 9) - python3 scripts/verify-valid-fixes.py PASS - node --check on every affected delivery view syntax OK JDK 1.8.0 compatible. No CHANGELOG.md entry per AGENTS.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
After PR #62 merged, a new CodeQL scan surfaced 9
js/xss-through-domalerts in
delivery/common/js/views/. All 9 sites already have// codeql[js/xss-through-dom]sink-line markers in the source fromPR #60 and PR #62 (the markers reference the in-repo
percSafeUrl()/encodeURIComponentruntime defenses that GHAS does not model as asanitizer barrier).
This is a documentation-only pass to assign the proper disposition
(
false-positive) to each row insuppressions.mdso the nextGHAS re-scan can dismiss them cleanly.
Disposition
Each of the 9 alerts already has a sink-line
// codeql[js/xss-through-dom]marker on the line above the sink. The marker references the runtime
defense (in-repo
percSafeUrl()helper that blocksjavascript:/``vbscript:/``data:schemes, plusencodeURIComponenton the filter value). All 9 will dismiss on the next CodeQL scan.
Validation
python3 scripts/verify-suppressions.py— PASSpython3 scripts/verify-triage-inventory.py— PASS (9 of 9)python3 scripts/verify-valid-fixes.py— PASSnode --checkon every affected delivery view — syntax OKJDK 1.8.0 compatible. No CHANGELOG.md entry per AGENTS.md.