From fe8a9e4421a4f84415e267d9d14cc106158a23bb Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Sat, 1 Aug 2026 13:30:47 +0200 Subject: [PATCH 1/4] docs(deepsource): log re-surfaced JS-0440 finding (local-only, not for push) Co-Authored-By: GitHub Copilot (Claude Sonnet 5) --- docs/DEEPSOURCE-REVIEW-LOOP.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/docs/DEEPSOURCE-REVIEW-LOOP.md b/docs/DEEPSOURCE-REVIEW-LOOP.md index 957628496..d79377f19 100644 --- a/docs/DEEPSOURCE-REVIEW-LOOP.md +++ b/docs/DEEPSOURCE-REVIEW-LOOP.md @@ -303,6 +303,25 @@ GitHub App resumes auto-reviewing, run **both** loops: CodeAnt for narrative/AI likely scopes JS-R1005/JS-C1002 similarly for this file, or the file is decomposed) — an agent should not attempt that maintainer-only dashboard action nor a speculative mass-refactor of this critical middleware file as a side effect of an unrelated feature PR. +- **2026-08-01 (LOCAL-ONLY entry — not pushed to remote)** — Re-checked the dashboard "Security" + category: **JS-0440** (`Dangerous property 'dangerouslySetInnerHTML' found`, **Major**, OWASP + A03/SANS-Top-25/CWE-937) is still listed as an **active, non-ignored** occurrence in + [`components/HelpView.tsx`](../components/HelpView.tsx) (the `dangerouslySetInnerHTML={{ __html: + DOMPurify.sanitize(t(selectedArticle.content)) }}` block, already wrapped in + `biome-ignore-start/end lint/security/noDangerouslySetInnerHtml: sanitized with DOMPurify`). This + **contradicts** the 2026-06-24 log line above claiming "JS-0440 dashboard-ignored, reviewed-safe" — + either that ignore never persisted for this occurrence or a later scan re-surfaced it; the dashboard + ignore state should **not** be trusted without re-verifying per PR. Disposition: **accepted risk, + no code change needed** — content is sanitized through `DOMPurify.sanitize()` before render, matching + the repo-wide rule ("`dangerouslySetInnerHTML` only with DOMPurify-sanitized content"); DeepSource's + static analyzer flags the JSX prop categorically and cannot trace the sanitization dataflow. **TODO + for later execution (maintainer, local-only tracking — do not push this entry upstream):** + (1) click **Ignore** on this specific occurrence in the DeepSource dashboard again (Issues → JS-0440 + → `components/HelpView.tsx`) and confirm it survives the next full-repo scan; (2) if it keeps + re-surfacing, consider a rule-level ignore for JS-0440 repo-wide given every `dangerouslySetInnerHTML` + call site in this codebase already goes through DOMPurify (grep confirms no raw usages); (3) audit + whether any *other* file uses `dangerouslySetInnerHTML` without the same DOMPurify + biome-ignore + pairing (none found via `grep -rn dangerouslySetInnerHTML` as of this date — only `HelpView.tsx`). --- From 86b0e940a989c4e77a52d9fba25fca7855963530 Mon Sep 17 00:00:00 2001 From: qnbs <155236708+qnbs@users.noreply.github.com> Date: Sat, 1 Aug 2026 13:32:10 +0200 Subject: [PATCH 2/4] docs(deepsource): correct stale JS-0440 disposition, re-surfaced 2026-08-01 (local-only) Co-Authored-By: GitHub Copilot (Claude Sonnet 5) --- docs/DEEPSOURCE-REMEDIATION-PLAN.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/DEEPSOURCE-REMEDIATION-PLAN.md b/docs/DEEPSOURCE-REMEDIATION-PLAN.md index bbdb9416d..5bd1199d1 100644 --- a/docs/DEEPSOURCE-REMEDIATION-PLAN.md +++ b/docs/DEEPSOURCE-REMEDIATION-PLAN.md @@ -71,7 +71,7 @@ Fix in this order — highest user/security impact first; cosmetic last. Within | Issue code | Title | Occ. | Files / modules | Decision | Status | PR | |---|---|---|---|---|---|---| | CWE/SANS Top-25 rows | code-level Top-25 CWE violations | **0** | — | none needed (clean) | done | — | -| **JS-0440** | Avoid dangerous JSX props — `dangerouslySetInnerHTML` (CWE-937 / OWASP; the report's "1 active") | 1 | `components/HelpView.tsx:125` | **dashboard "Ignore" (reviewed-safe)** — `__html` is `DOMPurify.sanitize()`d (repo's documented safe pattern); not a real XSS. In-code `skipcq` can't attach to a JSX attribute (§4b). | maintainer-click | — | +| **JS-0440** | Avoid dangerous JSX props — `dangerouslySetInnerHTML` (CWE-937 / OWASP; the report's "1 active") | 1 | `components/HelpView.tsx:125` | **dashboard "Ignore" (reviewed-safe)** — `__html` is `DOMPurify.sanitize()`d (repo's documented safe pattern); not a real XSS. In-code `skipcq` can't attach to a JSX attribute (§4b). **Re-surfaced 2026-08-01** as an active, non-ignored **Major** finding on the dashboard — the 2026-06-24 ignore click did not persist (or a rescan reset it); re-click Ignore and re-verify after the next full-repo scan. | todo (re-ignore + verify) | — | ### P1 — Bug-risk / Reliability | Issue code | Title | Occ. | Files / modules | Decision | Status | PR | @@ -150,7 +150,7 @@ config level (`.deepsource.toml`) instead of scattering inline `skipcq`. Log eac | Rule / analyzer | Action | Rationale | Date | |---|---|---|---| | **JS-0323** (`any`) | dashboard rule-ignore, **test-file scope** | 34 occ all in test mocks, already governed by Biome `noExplicitAny` + the suppression ratchet (baseline 52); double-suppressing is noise. 0 production `any`. Long-term cleanup → §4c. | 2026-06-24 | -| **JS-0440** (`dangerouslySetInnerHTML`) | dashboard "Ignore" (single occurrence) | reviewed-safe — `__html` is DOMPurify-sanitized (repo policy). In-code skipcq can't attach to a JSX attribute (§4b). | 2026-06-24 | +| **JS-0440** (`dangerouslySetInnerHTML`) | dashboard "Ignore" (single occurrence) — **re-click needed, see §11 in `DEEPSOURCE-REVIEW-LOOP.md`** | reviewed-safe — `__html` is DOMPurify-sanitized (repo policy). In-code skipcq can't attach to a JSX attribute (§4b). Ignore did not survive to 2026-08-01; re-verified as still safe, only the dashboard-suppression state needs re-applying. | 2026-06-24 (re-observed 2026-08-01) | | **JS-0067** ("unexpected function declaration in the global scope") | recommend dashboard rule-ignore (not yet actioned — maintainer click) | flagged on PR #305 for ordinary top-level `function`/`async function` declarations in `services/ai/localAiDeviceProfiler.ts` + `services/workerBusManager.ts` — idiomatic Biome-approved ES-module code, not `