Context
Completing the CodeQL high-severity triage started under #15366. The newly-active ruleset flagged 11 highs; the sweep resolved them: 1 real (Phone ReDoS — #15366 / PR #15381), 5 false positives dismissed (apps/devindex/services/Spider.mjs insecure-randomness — Math.random() selects a crawl target, no security boundary), and 5 remaining low-impact-but-real incomplete-sanitization alerts this ticket closes. Clearing them gives a clean high-severity baseline so the next real alert is not buried in the surface "none of us opens."
The Problem
Two single-pass replacements that a crafted input can partially survive (js/incomplete-*-sanitization):
- webpack ×2 —
buildScripts/webpack/{development,production}/webpack.config.appworker.mjs: content.appPath.replace(/\.\.\//g, ''). Global, but a single pass over ....// collapses to ../ (the removed ../ re-forms), so path-traversal segments can survive. Low real impact (build-time, developer-controlled appPath), but a true positive for the rule.
- covid ×3 —
examples/table/covid/TableContainerController.mjs:37, apps/covid/view/MainContainerController.mjs:84, apps/sharedcovid/view/MainContainerController.mjs:101: item.country.replace('"', "\'") is non-global — only the first " in a country name is replaced. Cosmetic (Neo VDOM escapes; not innerHTML), but incomplete.
The Fix
- webpack: loop the
../ strip until stable (fixpoint) so no traversal segment can re-form.
- covid: make the quote replacement global (
/"/g).
Behavior-preserving for all real inputs; only the incompleteness is closed.
Acceptance Criteria
Out of Scope
- The Phone ReDoS (#15366 / PR #15381) and the dismissed Spider false positives.
- Any broader covid-demo or webpack-config redesign.
Related
Follow-up to #15366 (the CodeQL sweep) · sibling security-pattern hygiene.
Origin Session ID: 3f892890-5ce2-4045-8290-dbbdff1b987a
Live latest-open sweep: checked latest 15 open at 2026-07-17T18:09Z; no equivalent CodeQL-sanitization ticket. A2A: no in-flight claim on these paths.
Context
Completing the CodeQL high-severity triage started under #15366. The newly-active ruleset flagged 11 highs; the sweep resolved them: 1 real (Phone ReDoS — #15366 / PR #15381), 5 false positives dismissed (
apps/devindex/services/Spider.mjsinsecure-randomness—Math.random()selects a crawl target, no security boundary), and 5 remaining low-impact-but-real incomplete-sanitization alerts this ticket closes. Clearing them gives a clean high-severity baseline so the next real alert is not buried in the surface "none of us opens."The Problem
Two single-pass replacements that a crafted input can partially survive (
js/incomplete-*-sanitization):buildScripts/webpack/{development,production}/webpack.config.appworker.mjs:content.appPath.replace(/\.\.\//g, ''). Global, but a single pass over....//collapses to../(the removed../re-forms), so path-traversal segments can survive. Low real impact (build-time, developer-controlledappPath), but a true positive for the rule.examples/table/covid/TableContainerController.mjs:37,apps/covid/view/MainContainerController.mjs:84,apps/sharedcovid/view/MainContainerController.mjs:101:item.country.replace('"', "\'")is non-global — only the first"in a country name is replaced. Cosmetic (Neo VDOM escapes; notinnerHTML), but incomplete.The Fix
../strip until stable (fixpoint) so no traversal segment can re-form./"/g).Behavior-preserving for all real inputs; only the incompleteness is closed.
Acceptance Criteria
js/incomplete-*-sanitizationhigh alerts clear on the nextdevCodeQL scan.appPathwith nested....//fully strips to no../(fixpoint), verified by a targeted assertion."has all replaced.Out of Scope
Related
Follow-up to #15366 (the CodeQL sweep) · sibling security-pattern hygiene.
Origin Session ID:
3f892890-5ce2-4045-8290-dbbdff1b987aLive latest-open sweep: checked latest 15 open at 2026-07-17T18:09Z; no equivalent CodeQL-sanitization ticket. A2A: no in-flight claim on these paths.