fix(security): resolve 82 CodeQL code-scanning alerts

[erseco]

Summary

Resolves 82 CodeQL "code scanning" alerts (all high/medium severity) across the backend, the frontend, the iDevice runtimes, the exporters and the legacy importers. Every fix is a minimal, behaviour-preserving change to a real source file, paired with a colocated test asserting the security property. No iDevice behaviour, export output or accepted input is altered for legitimate content.

Alerts come from the upstream code-scanning dashboard (exelearning/exelearning → Security → Code scanning). This PR targets the safe, mechanical, low-risk classes; the larger js/xss-through-dom campaign in shipped iDevice rendering is intentionally deferred (see below).

What's fixed (by rule)

Rule	Fixed	Fix applied
js/incomplete-multi-character-sanitization	27	Loop each tag/handler strip to a fixed point so removing one match can't splice two halves into a new <script>/on*=/scheme match
js/incomplete-sanitization	20	Add the global flag, or escape backslashes before the delimiter (e.g. escapeCatalogueKey)
js/double-escaping	11	Decode &amp; last in entity-decode chains so &amp;lt; no longer collapses to <
js/incomplete-url-substring-sanitization	7	Replace url.includes('host')/startsWith('https://host') with new URL() + exact hostname/pathname checks (rejects host.evil.com)
js/incomplete-url-scheme-check	5	Also reject vbscript:/data: (case-insensitive, whitespace/control/entity tolerant); allowlist where possible
js/bad-tag-filter	5	End-tag regex now tolerates </script > (whitespace/newline/case)
js/prototype-pollution-utility	1	Skip __proto__/prototype/constructor keys in the deep-merge
js/cross-window-information-leak	1	Drop the postMessage(msg, '*') fallback in EmbeddingBridge; log instead
js/insecure-randomness	1	Web Crypto (crypto.getRandomValues/randomUUID) instead of the non-crypto PRNG
actions/missing-workflow-permissions	1	Least-privilege permissions: block on e2e-db-matrix.yml
js/insecure-download	1	Validate/enforce a safe scheme before fetching
js/functionality-from-untrusted-source	1	https + Subresource Integrity (verified sha512 against cdnjs) for the FileSaver.js CDN tag
js/overly-large-range	1	Narrow [a-zA-z] → [a-zA-Z] in the mathproblems placeholder regex (both export and edition twins)

Notable details

• Shared SVG scrubber (slide) — src/sanitizer.ts and its hand-maintained export/slide.js twin: fixed-point scrubbing loop, tolerant </script\s*>, vbscript:/data:text/html removal (legit data:image/... preserved), and the <foreignObject> strip is now present in both twins.
• LinkValidationAdapter._hasDangerousScheme — numeric-entity decoding is guarded so out-of-range code points (e.g. �) can't throw a RangeError (regression test added).
• common.js media URLs — Google Drive / mediateca extraction now parses the URL and matches the exact host + path; relative URLs and look-alike hosts are rejected, all legitimate links still resolve.

Deferred / not changed (deliberate)

• 2 × js/stored-xss in LatexPreRenderer.js — skipped, documented as safe. The flow parses author HTML into an inert DOMParser document and re-serialises it; the only newly-injected markup is the library-rendered MathJax <svg>/<math> wrapper whose data-latex is attribute-escaped. Scrubbing here would delete legitimate author markup (TikZ/code iDevices, embedded widgets). A security-note comment plus round-trip tests were added.
• 4 × js/incomplete-url-substring-sanitization located inside test bodies — skipped; these are intentional assertions/matchers over hardcoded, controlled strings (not URL-trust decisions). Rewriting them would weaken the tests for zero security benefit.
• 146 × js/xss-through-dom in shipped iDevice rendering — out of scope for this PR. They are heterogeneous and behaviour-sensitive (jQuery $(attr) selectors, .html('<p>'+el.text()+'</p>') round-trips, trusted rendered SVG/mermaid) and warrant their own focused, E2E-backed effort.

CodeQL fixture/vendor alerts (context, no action here)

The dashboard also lists ~304 alerts inside generated export fixtures (test/fixtures/export/**) and a couple in vendored libs. These are copies of source that regenerate; they can't be fixed by editing the generated files. The repo uses CodeQL default setup, which ignores .github/codeql/codeql-config.yml, so a paths-ignore entry would not clear them. They are left untouched here (they age out as fixtures are regenerated from the fixed source, or can be dismissed in the UI).

Testing

• make fix — clean (the single remaining Biome warning, noExplicitAny in src/routes/export.ts, pre-exists on main and is unrelated).
• make test-unit — 7160 pass / 0 fail, and all files meet the 90% coverage threshold.
• make test-frontend — green (Vitest + happy-dom).
• make test-integration — green.
• New colocated tests ship with every changed source file; behaviour-sensitive fixes (scheme checks, decode order, scrubbing loops, URL parsing, prototype-pollution, postMessage origin) assert both "payload blocked" and "legitimate input preserved".

Each fix was additionally checked by an independent adversarial review pass (correctness, behaviour preservation, regex backtracking, twin-sync). Two blockers it surfaced — a RangeError in the entity decoder and an out-of-sync mathproblems edition twin — are fixed in this PR.

Review follow-ups (post-review hardening)

A multi-agent review of this branch surfaced three items, now fixed in commit b53a50f:

• js/cross-window-information-leak — residual wildcard postMessage closed. EmbeddingBridge._announceDocumentLoaded still posted DOCUMENT_LOADED (projectId, isDirty, pageCount) to this.parentOrigin || '*', so project metadata could broadcast to any embedding origin if the document loaded before the parent handshake set a trusted origin. It now routes through postToParent, inheriting the known-origin guard (dropped instead of broadcast when the origin is unknown). The pre-existing test that asserted the old '*' behaviour was updated to assert the non-leak.
• Server/client scheme-filter parity. The server normalizeUrlForSchemeCheck (link-validator.ts) only decoded whitespace/control entities, so entity-encoded scheme characters (javascript:, javascript:, data:…) slipped past the broken-link checker while the client LinkValidationAdapter._hasDangerousScheme caught them. The server now decodes the full named/numeric entity set with the same out-of-range-safe code-point helper, keeping both ends in sync. New tests cover the entity-encoded scheme chars and out-of-range numeric entities.
• Dead code removed. isUnsafeLinkScheme() in project.ts had zero call sites (superseded by the shared link-validator service's removeInvalidLinks); it and its spec block were removed so coverage isn't inflated by an unused export. The dangerous-scheme property remains covered server-side by link-validator.spec.ts.
• mindmaps CDN tags pinned (js/functionality-from-untrusted-source). The remaining protocol-relative CDN scripts in mindmaps/src/index.html were upgraded to https; jQuery 1.6.1 now carries a verified sha384 Subresource Integrity hash + crossorigin, matching the FileSaver.js tag. Filestack's legacy loader is an unversioned/mutable endpoint, so an SRI hash cannot be pinned without breaking on its next update — it is forced to https (documented inline).

Verified after the fixes: link-validator.spec.ts + project.spec.ts (260 pass), EmbeddingBridge.test.js + LinkValidationAdapter.test.js (109 pass), Biome clean on the changed src/ files. jQuery's SRI hash was computed from the bytes served by the CDN.

One item is deferred to its own PR: consolidating the duplicated fixed-point tag-strip into a shared sanitizer. The strip is a per-iDevice method duplicated across 30+ devices spanning two runtimes (the authoring iframe and the exported student package) that share no module system, so a clean dedup needs a new cross-runtime delivery mechanism — an architectural change better made on its own, with full test runs across all gamification iDevices, rather than expanding this 90-file security PR. The current strip code is correct and well-tested as-is.

[codecov]

Bundle Report

Changes will increase total bundle size by 503 bytes (0.03%) ⬆️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
app-bundle	856.95kB	387 bytes (0.05%) ⬆️
exporters-bundle	713.77kB	116 bytes (0.02%) ⬆️

Affected Assets, Files, and Routes:

view changes for bundle: app-bundle

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
app.bundle.js	387 bytes	856.95kB	0.05%

view changes for bundle: exporters-bundle

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
exporters.bundle.js	116 bytes	713.77kB	0.02%

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-07-15 19:41 UTC