Skip to content

fix(core): contain generated HTML CSS and script contexts - #3800

Merged
jrusso1020 merged 8 commits into
mainfrom
fix/security-generator-attributes
Sep 9, 2026
Merged

jrusso1020 merged 8 commits into
mainfrom
fix/security-generator-attributes

fix(core): preserve empty captions and document authored code trust

3ccbcf8
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / CodeQL succeeded Sep 9, 2026 in 3s

No new alerts in code changed by this pull request

Annotations

Check warning on line 296 in packages/core/src/generators/hyperframes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe code constructed from library input Medium

This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.

Check warning on line 296 in packages/core/src/generators/hyperframes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe code constructed from library input Medium

This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.

Check warning on line 314 in packages/core/src/generators/hyperframes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe code constructed from library input Medium

This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.

Check warning on line 314 in packages/core/src/generators/hyperframes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe code constructed from library input Medium

This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.

Check warning on line 327 in packages/core/src/generators/hyperframes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe code constructed from library input Medium

This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.

Check warning on line 327 in packages/core/src/generators/hyperframes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe code constructed from library input Medium

This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.

Check warning on line 331 in packages/core/src/generators/hyperframes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe code constructed from library input Medium

This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.

Check warning on line 331 in packages/core/src/generators/hyperframes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe code constructed from library input Medium

This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.

Check warning on line 439 in packages/core/src/generators/hyperframes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe HTML constructed from library input Medium

This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.

Check warning on line 447 in packages/core/src/generators/hyperframes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe HTML constructed from library input Medium

This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.
This HTML construction which depends on
library input
might later allow
cross-site scripting
.

Check warning on line 794 in packages/core/src/generators/hyperframes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe code constructed from library input Medium

This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.

Check warning on line 863 in packages/core/src/generators/hyperframes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe code constructed from library input Medium

This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.

Check warning on line 864 in packages/core/src/generators/hyperframes.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe code constructed from library input Medium

This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.

Check warning on line 304 in packages/parsers/src/gsapSerialize.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe code constructed from library input Medium

This string concatenation which depends on
library input
is later
interpreted as code
.
This string concatenation which depends on
library input
is later
interpreted as code
.

Check warning on line 305 in packages/parsers/src/gsapSerialize.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe code constructed from library input Medium

This string concatenation which depends on
library input
is later
interpreted as code
.

Check warning on line 305 in packages/parsers/src/gsapSerialize.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unsafe code constructed from library input Medium

This string concatenation which depends on
library input
is later
interpreted as code
.