test - #69
Closed
natechadwick-intsof wants to merge 1 commit into
Closed
Conversation
9 open js/xss-through-dom alerts on delivery/common/js/views/Perc*View.js href / window.location sinks closed by inlining the URL scheme sanitizer at the sink, instead of relying on the in-repo percSafeUrl() helper. PRs #60 and #62 added the helper, but .github/workflows/codeql.yml explicitly notes that GHA rejects local model-pack paths in the workflow packs: input, so GHAS does not model the in-repo helper as a sanitizer barrier. PR #62 acknowledged this and shipped sink-line // codeql[rule-id] suppressions; this PR replaces the helper with an inline /^\\s*(?:javascript|vbscript|data)\\s*:/i regex test that GHAS recognizes as a URL prefix guard at the taint boundary. Changes: - delivery/common/js/views/PercBlogPostView.js: drop percSafeUrl helper; inline regex test before .attr("href", href) at both the tag (#716) and category (#717) sinks. - delivery/common/js/views/PercArchiveListView.js: drop percSafeUrl helper; inline regex test before the hierarchical year (#709), hierarchical month (#710), and flat-list month (#711) sinks. - delivery/common/js/views/PercCategoryListView.js: drop percSafeUrl helper; inline regex test (as a ternary to keep the jQuery chain intact) at the parseNode href sink (#712). - delivery/common/js/views/PercRegistrationView.js: drop percSafeUrl helper; inline regex test on both window.location sinks (confirmation-page redirect #714, rvkey redirect #713); fallback to "/" since the original helper returned that for invalid schemes. - delivery/common/js/views/PercTagListView.js: drop percSafeUrl helper; inline regex test before .attr("href", href) at the tag sink (#718). - docs/ai-generated/tasks/8.1.x-codeql-baseline/suppressions.md: drop the 9 js/xss-through-dom rows for the alerts being fixed (#709-#714, #716-#718) plus 3 stale rows for the alerts PR #62 already closed (#707, #708, #715). The corresponding // codeql[js/xss-through-dom] sink-line markers are gone from the source, so the verify-suppressions.py greps would otherwise fail. - docs/ai-generated/tasks/8.1.x-codeql-baseline/triage.md: keep the 9 rows (alerts are still open in alerts.md until the next GHAS scan dismisses them) but update notes to describe the actual code fix and the post-fix line numbers; row count still matches alerts.md so verify-triage-inventory.py stays green. - docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md: cluster row updated to point at this PR and note the inlined sanitizer pattern; per-alert line numbers refreshed. Verification: - node --check on each modified file syntax OK - python3 scripts/verify-suppressions.py PASS - python3 scripts/verify-triage-inventory.py PASS (9 == 9) - python3 scripts/verify-valid-fixes.py PASS JDK 1.8.0 compatible (JS only). No CHANGELOG.md entry per AGENTS.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
test