diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md index 7975865c67..464188b48b 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md @@ -3,235 +3,83 @@ State filter: open Generated: (python port — timestamp not embedded; see file mtime) -- **Alert #706** — `js/incomplete-sanitization` (high, CodeQL) +- **Alert #718** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open - - **Created:** 2026-08-15T20:10:01Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/706 - - **Location:** cui/widgets/app/app.viewmodel.js:88 - - **Message:** This does not escape backslash characters in the input. - - -- **Alert #705** — `js/incomplete-sanitization` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-15T20:10:01Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/705 - - **Location:** cui/widgets/app/app.viewmodel.js:88 - - **Message:** This does not escape backslash characters in the input. - - -- **Alert #704** — `java/path-injection` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-15T00:32:59Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/704 - - **Location:** projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:216 - - **Message:** This path depends on a user-provided value. - - -- **Alert #477** — `java/path-injection` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:23:01Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/477 - - **Location:** projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:519 - - **Message:** This path depends on a user-provided value. -This path depends on a user-provided value. - - -- **Alert #476** — `java/path-injection` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:23:01Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/476 - - **Location:** projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:518 - - **Message:** This path depends on a user-provided value. -This path depends on a user-provided value. - - -- **Alert #474** — `java/path-injection` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:23:01Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/474 - - **Location:** projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:403 - - **Message:** This path depends on a user-provided value. - - -- **Alert #467** — `java/path-injection` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:23:01Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/467 - - **Location:** projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:182 - - **Message:** This path depends on a user-provided value. -This path depends on a user-provided value. -This path depends on a user-provided value. -This path depends on a user-provided value. -This path depends on a user-provided value. -This path depends on a user-provided value. -This path depends on a user-provided value. - - -- **Alert #457** — `java/path-injection` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:23:01Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/457 - - **Location:** projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java:451 - - **Message:** This path depends on a user-provided value. - - -- **Alert #456** — `java/path-injection` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:23:01Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/456 - - **Location:** projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java:419 - - **Message:** This path depends on a user-provided value. - - -- **Alert #455** — `java/path-injection` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:23:01Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/455 - - **Location:** projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java:364 - - **Message:** This path depends on a user-provided value. - - -- **Alert #454** — `java/path-injection` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:23:01Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/454 - - **Location:** projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/helpers/impl/PSImportThemeHelper.java:257 - - **Message:** This path depends on a user-provided value. - - -- **Alert #143** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/143 - - **Location:** delivery/common/js/views/PercTagListView.js:115 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #142** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/142 - - **Location:** delivery/common/js/views/PercRssView.js:144 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #141** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/141 - - **Location:** delivery/common/js/views/PercRssView.js:140 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #140** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/140 - - **Location:** delivery/common/js/views/PercRssView.js:64 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #139** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/139 - - **Location:** delivery/common/js/views/PercRegistrationView.js:260 - - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. - - -- **Alert #138** — `js/xss-through-dom` (high, CodeQL) - - **Tool:** CodeQL - - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/138 - - **Location:** delivery/common/js/views/PercRegistrationView.js:72 + - **Created:** 2026-08-15T22:36:30Z + - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/718 + - **Location:** delivery/common/js/views/PercTagListView.js:123 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. -- **Alert #137** — `js/xss-through-dom` (high, CodeQL) +- **Alert #717** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/137 - - **Location:** delivery/common/js/views/PercMostReadBlogPostsView.js:105 + - **Created:** 2026-08-15T22:36:30Z + - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/717 + - **Location:** delivery/common/js/views/PercBlogPostView.js:162 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. -- **Alert #136** — `js/xss-through-dom` (high, CodeQL) +- **Alert #716** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/136 - - **Location:** delivery/common/js/views/PercMostReadBlogPostsView.js:70 + - **Created:** 2026-08-15T22:36:30Z + - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/716 + - **Location:** delivery/common/js/views/PercBlogPostView.js:152 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. -- **Alert #135** — `js/xss-through-dom` (high, CodeQL) +- **Alert #714** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/135 - - **Location:** delivery/common/js/views/PercCategoryListView.js:192 + - **Created:** 2026-08-15T20:29:35Z + - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/714 + - **Location:** delivery/common/js/views/PercRegistrationView.js:272 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. -- **Alert #134** — `js/xss-through-dom` (high, CodeQL) +- **Alert #713** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/134 - - **Location:** delivery/common/js/views/PercArchiveListView.js:279 + - **Created:** 2026-08-15T20:29:35Z + - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/713 + - **Location:** delivery/common/js/views/PercRegistrationView.js:83 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. -- **Alert #133** — `js/xss-through-dom` (high, CodeQL) +- **Alert #712** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/133 - - **Location:** delivery/common/js/views/PercBlogPostView.js:153 + - **Created:** 2026-08-15T20:29:35Z + - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/712 + - **Location:** delivery/common/js/views/PercCategoryListView.js:199 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. -- **Alert #132** — `js/xss-through-dom` (high, CodeQL) +- **Alert #711** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/132 - - **Location:** delivery/common/js/views/PercArchiveListView.js:191 + - **Created:** 2026-08-15T20:29:35Z + - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/711 + - **Location:** delivery/common/js/views/PercArchiveListView.js:288 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. -- **Alert #131** — `js/xss-through-dom` (high, CodeQL) +- **Alert #710** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/131 - - **Location:** delivery/common/js/views/PercBlogPostView.js:144 + - **Created:** 2026-08-15T20:29:35Z + - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/710 + - **Location:** delivery/common/js/views/PercArchiveListView.js:199 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. -- **Alert #130** — `js/xss-through-dom` (high, CodeQL) +- **Alert #709** — `js/xss-through-dom` (high, CodeQL) - **Tool:** CodeQL - **State:** open - - **Created:** 2026-08-03T23:19:27Z - - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/130 - - **Location:** delivery/common/js/views/PercArchiveListView.js:131 + - **Created:** 2026-08-15T20:29:35Z + - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/709 + - **Location:** delivery/common/js/views/PercArchiveListView.js:138 - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters. diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md index 4b7cf1e816..33a2d993b2 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md @@ -1,43 +1,27 @@ # CodeQL Critical+High Clusters on 8.1.x (main) -Generated: 2026-08-15T21:14:20Z +Generated: 2026-08-18T00:08:10Z Source: docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md ## Summary -- Total open alerts: 25 -- Critical+High open: 25 -- Cluster count: 3 +- Total open alerts: 9 +- Critical+High open: 9 +- Cluster count: 1 ## Cluster Map | Rule | Severity | Count | Reference 004 PR | Notes | |---|---|---|---|---| -| `js/xss-through-dom` | high | 14 | TBD | 8.1.x: post-merge residual | -| `java/path-injection` | high | 9 | PR #1365 + #1362 + #1361 | 8.1.x: post-merge residual | -| `js/incomplete-sanitization` | high | 2 | TBD | 8.1.x: post-merge residual | +| `js/xss-through-dom` | high | 9 | TBD | 8.1.x: sink-line suppressions in place; awaiting CodeQL re-scan | ## Per-Cluster Detail -### `js/xss-through-dom` (14 alerts) +### `js/xss-through-dom` (9 alerts) -- Alert #143 — `delivery/common/js/views/PercTagListView.js:115` -- Alert #142 — `delivery/common/js/views/PercRssView.js:144` -- Alert #141 — `delivery/common/js/views/PercRssView.js:140` -- Alert #140 — `delivery/common/js/views/PercRssView.js:64` -- Alert #139 — `delivery/common/js/views/PercRegistrationView.js:260` -- ... and 9 more - -### `java/path-injection` (9 alerts) - -- Alert #704 — `projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:216` -- Alert #477 — `projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:519` -- Alert #476 — `projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:518` -- Alert #474 — `projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:403` -- Alert #467 — `projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:182` +- Alert #718 — `delivery/common/js/views/PercTagListView.js:123` +- Alert #717 — `delivery/common/js/views/PercBlogPostView.js:162` +- Alert #716 — `delivery/common/js/views/PercBlogPostView.js:152` +- Alert #714 — `delivery/common/js/views/PercRegistrationView.js:272` +- Alert #713 — `delivery/common/js/views/PercRegistrationView.js:83` - ... and 4 more - -### `js/incomplete-sanitization` (2 alerts) - -- Alert #706 — `cui/widgets/app/app.viewmodel.js:88` -- Alert #705 — `cui/widgets/app/app.viewmodel.js:88` diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/suppressions.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/suppressions.md index f53fbed2b5..6bc7f3039f 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/suppressions.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/suppressions.md @@ -153,3 +153,6 @@ Row schema (per spec 004 C2 contract): | 713 | js/xss-through-dom | delivery/common/js/views/PercRegistrationView.js | 82 | percSafeUrl() helper blocks javascript:/vbscript:/data: schemes at this location.href sink; GHAS does not model the in-repo helper as a sanitizer barrier; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line suppression: same helper as #709 | | 714 | js/xss-through-dom | delivery/common/js/views/PercRegistrationView.js | 270 | percSafeUrl() helper blocks javascript:/vbscript:/data: schemes at this location sink; GHAS does not model the in-repo helper as a sanitizer barrier; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | sink-line suppression: same helper as #709 | | 715 | js/xss-through-dom | delivery/common/js/views/PercTagListView.js | 115 | percSafeUrl() helper blocks javascript:/vbscript:/data: schemes at this href sink; GHAS does not model the in-repo helper as a sanitizer barrier; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | code fix: added percSafeUrl helper + wrapped .attr(href) call; encodeURIComponent already on tag value | +| 716 | js/xss-through-dom | delivery/common/js/views/PercBlogPostView.js | 152 | percSafeUrl() helper blocks javascript:/vbscript:/data: schemes at this href sink; GHAS does not model the in-repo helper as a sanitizer barrier; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | code fix: percSafeUrl() helper added in PR #62; sink-line // codeql marker on line 151 | +| 717 | js/xss-through-dom | delivery/common/js/views/PercBlogPostView.js | 162 | percSafeUrl() helper blocks javascript:/vbscript:/data: schemes at this href sink; GHAS does not model the in-repo helper as a sanitizer barrier; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | code fix: same helper as #716; sink-line // codeql marker on line 161 | +| 718 | js/xss-through-dom | delivery/common/js/views/PercTagListView.js | 123 | percSafeUrl() helper blocks javascript:/vbscript:/data: schemes at this href sink; GHAS does not model the in-repo helper as a sanitizer barrier; re-review by 2027-07-31 | 2026-08-15 | 2027-07-31 | this PR | code fix: percSafeUrl() helper added in PR #62; sink-line // codeql marker on line 122 | diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/triage.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/triage.md index f543e9479a..11ed812d42 100644 --- a/docs/ai-generated/tasks/8.1.x-codeql-baseline/triage.md +++ b/docs/ai-generated/tasks/8.1.x-codeql-baseline/triage.md @@ -2,41 +2,24 @@ Every open Critical/High alert gets exactly one row here. The pipeline gates (`scripts/verify-triage-inventory.py`, `scripts/verify-valid-fixes.py`) read this file. -Generated: 2026-08-15T21:14:20Z +Generated: 2026-08-18T00:08:10Z Source: docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md ## Summary -- Total open alerts: 25 -- false-positive: 9 -- fix: 16 +- Total open alerts: 9 +- fix: 9 Schema (per spec 004 C1): | # | alert_id | rule_id | severity | file_path | module_owner | disposition (candidate) | target_action | target_milestone | linked_pr | notes | |---|----------|---------|----------|-----------|--------------|-------------------------|---------------|------------------|-----------|-------| -| 1 | 706 | js/incomplete-sanitization | high | cui/widgets/app/app.viewmodel.js:88 | cui | fix | code fix required | TBD | | | -| 2 | 705 | js/incomplete-sanitization | high | cui/widgets/app/app.viewmodel.js:88 | cui | fix | code fix required | TBD | | | -| 3 | 704 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:216 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (#justification: runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual) @ line 77 | -| 4 | 477 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:519 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (#justification: runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual) @ line 77 | -| 5 | 476 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:518 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (#justification: runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual) @ line 77 | -| 6 | 474 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:403 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (#justification: runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual) @ line 77 | -| 7 | 467 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java:182 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/theme/service/impl/PSThemeService.java (#justification: runtime path-injection guard at or above sink; GHAS does not model in-repo guard; path-ignore residual) @ line 77 | -| 8 | 457 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java:451 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java (#see config) @ line 78 | -| 9 | 456 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java:419 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java (#see config) @ line 78 | -| 10 | 455 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java:364 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/theme/PSCSSParser.java (#see config) @ line 78 | -| 11 | 454 | java/path-injection | high | projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/helpers/impl/PSImportThemeHelper.java:257 | projects/sitemanage | false-positive | no action; path-ignored in .github/codeql/codeql-config.yml | merged | | paths-ignore projects/sitemanage/src/main/java/com/percussion/sitemanage/importer/helpers/impl/PSImportThemeHelper.java (#see config) @ line 79 | -| 12 | 143 | js/xss-through-dom | high | delivery/common/js/views/PercTagListView.js:115 | delivery | fix | code fix required | TBD | | | -| 13 | 142 | js/xss-through-dom | high | delivery/common/js/views/PercRssView.js:144 | delivery | fix | code fix required | TBD | | | -| 14 | 141 | js/xss-through-dom | high | delivery/common/js/views/PercRssView.js:140 | delivery | fix | code fix required | TBD | | | -| 15 | 140 | js/xss-through-dom | high | delivery/common/js/views/PercRssView.js:64 | delivery | fix | code fix required | TBD | | | -| 16 | 139 | js/xss-through-dom | high | delivery/common/js/views/PercRegistrationView.js:260 | delivery | fix | code fix required | TBD | | | -| 17 | 138 | js/xss-through-dom | high | delivery/common/js/views/PercRegistrationView.js:72 | delivery | fix | code fix required | TBD | | | -| 18 | 137 | js/xss-through-dom | high | delivery/common/js/views/PercMostReadBlogPostsView.js:105 | delivery | fix | code fix required | TBD | | | -| 19 | 136 | js/xss-through-dom | high | delivery/common/js/views/PercMostReadBlogPostsView.js:70 | delivery | fix | code fix required | TBD | | | -| 20 | 135 | js/xss-through-dom | high | delivery/common/js/views/PercCategoryListView.js:192 | delivery | fix | code fix required | TBD | | | -| 21 | 134 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:279 | delivery | fix | code fix required | TBD | | | -| 22 | 133 | js/xss-through-dom | high | delivery/common/js/views/PercBlogPostView.js:153 | delivery | fix | code fix required | TBD | | | -| 23 | 132 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:191 | delivery | fix | code fix required | TBD | | | -| 24 | 131 | js/xss-through-dom | high | delivery/common/js/views/PercBlogPostView.js:144 | delivery | fix | code fix required | TBD | | | -| 25 | 130 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:131 | delivery | fix | code fix required | TBD | | | +| 1 | 718 | js/xss-through-dom | high | delivery/common/js/views/PercTagListView.js:123 | delivery | fix | code fix required | TBD | | | +| 2 | 717 | js/xss-through-dom | high | delivery/common/js/views/PercBlogPostView.js:162 | delivery | fix | code fix required | TBD | | | +| 3 | 716 | js/xss-through-dom | high | delivery/common/js/views/PercBlogPostView.js:152 | delivery | fix | code fix required | TBD | | | +| 4 | 714 | js/xss-through-dom | high | delivery/common/js/views/PercRegistrationView.js:272 | delivery | fix | code fix required | TBD | | suppressions.md lists this alert under delivery/common/js/views/PercRegistrationView.js (linked_pr=this PR); path-ignore not yet applied | +| 5 | 713 | js/xss-through-dom | high | delivery/common/js/views/PercRegistrationView.js:83 | delivery | fix | code fix required | TBD | | suppressions.md lists this alert under delivery/common/js/views/PercRegistrationView.js (linked_pr=this PR); path-ignore not yet applied | +| 6 | 712 | js/xss-through-dom | high | delivery/common/js/views/PercCategoryListView.js:199 | delivery | fix | code fix required | TBD | | suppressions.md lists this alert under delivery/common/js/views/PercCategoryListView.js (linked_pr=this PR); path-ignore not yet applied | +| 7 | 711 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:288 | delivery | fix | code fix required | TBD | | suppressions.md lists this alert under delivery/common/js/views/PercArchiveListView.js (linked_pr=this PR); path-ignore not yet applied | +| 8 | 710 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:199 | delivery | fix | code fix required | TBD | | suppressions.md lists this alert under delivery/common/js/views/PercArchiveListView.js (linked_pr=this PR); path-ignore not yet applied | +| 9 | 709 | js/xss-through-dom | high | delivery/common/js/views/PercArchiveListView.js:138 | delivery | fix | code fix required | TBD | | suppressions.md lists this alert under delivery/common/js/views/PercArchiveListView.js (linked_pr=this PR); path-ignore not yet applied |