{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T15:16:10.791459Z","repo":{"ref":{"host":"github.com","owner":"BookStackApp","name":"BookStack"},"default_branch":"development","clone_url":"https://github.com/BookStackApp/BookStack.git","html_url":"https://github.com/BookStackApp/BookStack","description":"NOW MANAGED ON CODEBERG","stars":19145,"forks":2435,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":52739,"primary_language":"PHP","license_spdx":"MIT","created_at":"2015-08-29T10:26:44Z","pushed_at":"2026-11-14T04:30:55Z","security_policy_url":null,"distribution":{"owner_created_at":"2016-08-08T19:26:54Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"0b6b667e0d84ebb3406de6de9fadbf4230c29c0b","profile":{"lines_by_language":{"PHP":195354,"TypeScript":70516,"JavaScript":7037,"Shell":104,"SQL":5},"files_by_category":{"source":1981,"test":220,"other":198,"config":125,"vendored":48,"docs":29,"binary":20,"generated":2},"source_lines":217367,"test_lines":55649},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.0214,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":3.0,"flagged_releases":0.0,"style_index":0.009},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":62.3,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":71.5,"duplication":39.4,"lint":99.3,"testing":42.8,"docs":65.0,"type_safety":100.0,"process":50.0},"summary":"Code quality is weak: test-to-source ratio 0.26, no CI test run detected; 11% of function code in complex or long functions; 16% duplicated lines. Weakest area: duplication."},"security":{"score":69.7,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":87.5,"sast":90.1,"dependencies":76.6,"ci_actions":null,"posture":20.0,"scorecard":20.0},"summary":"Security posture is weak: 6 known vulnerabilities in 6 dependencies; 74 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":3.2,"check:Maintained":10.0,"check:Code-Review":0.0,"check:SAST":0.0,"check:CII-Best-Practices":0.0,"check:Binary-Artifacts":10.0,"check:Security-Policy":0.0,"check:Pinned-Dependencies":0.0,"check:License":10.0,"check:Fuzzing":0.0,"check:Branch-Protection":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Maintained: 10/10 (30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/BookStackApp/BookStack","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Code-Review: 0/10 (Found 0/30 approved changesets -- score normalized to 0)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/BookStackApp/BookStack","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (no SAST tool detected)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/BookStackApp/BookStack","weight":1.0},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/BookStackApp/BookStack","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/BookStackApp/BookStack","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/BookStackApp/BookStack","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Pinned-Dependencies: 0/10 (dependency not pinned by hash detected -- score normalized to 0)","ref":"Pinned-Dependencies","url":"https://scorecard.dev/viewer/?uri=github.com/BookStackApp/BookStack","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 10/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/BookStackApp/BookStack","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/BookStackApp/BookStack","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/BookStackApp/BookStack","weight":1.0}],"data":{"date":"2026-11-09","commit":"0b6b667e0d84ebb3406de6de9fadbf4230c29c0b","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":36.0,"checked":36.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":4853.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":439803.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2015-07":{"loc":4870,"attributed_loc":0},"2015-08":{"loc":4076,"attributed_loc":0},"2015-09":{"loc":3043,"attributed_loc":0},"2015-10":{"loc":896,"attributed_loc":0},"2015-11":{"loc":923,"attributed_loc":0},"2015-12":{"loc":2148,"attributed_loc":0},"2016-01":{"loc":1635,"attributed_loc":0},"2016-02":{"loc":2963,"attributed_loc":0},"2016-03":{"loc":3289,"attributed_loc":0},"2016-04":{"loc":1268,"attributed_loc":0},"2016-05":{"loc":2261,"attributed_loc":0},"2016-06":{"loc":680,"attributed_loc":0},"2016-07":{"loc":440,"attributed_loc":0},"2016-08":{"loc":865,"attributed_loc":0},"2016-09":{"loc":1784,"attributed_loc":0},"2016-10":{"loc":1607,"attributed_loc":0},"2016-11":{"loc":1013,"attributed_loc":0},"2016-12":{"loc":1679,"attributed_loc":0},"2017-01":{"loc":3659,"attributed_loc":0},"2017-02":{"loc":2559,"attributed_loc":0},"2017-03":{"loc":1675,"attributed_loc":0},"2017-04":{"loc":2755,"attributed_loc":0},"2017-05":{"loc":426,"attributed_loc":0},"2017-06":{"loc":1312,"attributed_loc":0},"2017-07":{"loc":2767,"attributed_loc":0},"2017-08":{"loc":4785,"attributed_loc":0},"2017-09":{"loc":4383,"attributed_loc":0},"2017-10":{"loc":187,"attributed_loc":0},"2017-11":{"loc":470,"attributed_loc":0},"2017-12":{"loc":1018,"attributed_loc":0},"2018-01":{"loc":2169,"attributed_loc":0},"2018-02":{"loc":1336,"attributed_loc":0},"2018-03":{"loc":817,"attributed_loc":0},"2018-04":{"loc":2686,"attributed_loc":0},"2018-05":{"loc":1100,"attributed_loc":0},"2018-06":{"loc":314,"attributed_loc":0},"2018-07":{"loc":2495,"attributed_loc":0},"2018-08":{"loc":1286,"attributed_loc":0},"2018-09":{"loc":3358,"attributed_loc":0},"2018-10":{"loc":2461,"attributed_loc":0},"2018-11":{"loc":475,"attributed_loc":0},"2018-12":{"loc":3565,"attributed_loc":0},"2019-01":{"loc":756,"attributed_loc":0},"2019-02":{"loc":2836,"attributed_loc":0},"2019-03":{"loc":1750,"attributed_loc":0},"2019-04":{"loc":2732,"attributed_loc":0},"2019-05":{"loc":1613,"attributed_loc":0},"2019-06":{"loc":1286,"attributed_loc":0},"2019-07":{"loc":2647,"attributed_loc":0},"2019-08":{"loc":2830,"attributed_loc":0},"2019-09":{"loc":2962,"attributed_loc":0},"2019-10":{"loc":8613,"attributed_loc":0},"2019-11":{"loc":1403,"attributed_loc":0},"2019-12":{"loc":3243,"attributed_loc":0},"2020-01":{"loc":3184,"attributed_loc":0},"2020-02":{"loc":2314,"attributed_loc":0},"2020-03":{"loc":4695,"attributed_loc":0},"2020-04":{"loc":3459,"attributed_loc":0},"2020-05":{"loc":899,"attributed_loc":0},"2020-06":{"loc":1615,"attributed_loc":0},"2020-07":{"loc":2090,"attributed_loc":0},"2020-08":{"loc":628,"attributed_loc":0},"2020-09":{"loc":3447,"attributed_loc":0},"2020-10":{"loc":1527,"attributed_loc":0},"2020-11":{"loc":2544,"attributed_loc":0},"2020-12":{"loc":906,"attributed_loc":0},"2021-01":{"loc":2922,"attributed_loc":0},"2021-02":{"loc":1764,"attributed_loc":0},"2021-03":{"loc":5836,"attributed_loc":0},"2021-04":{"loc":1285,"attributed_loc":0},"2021-05":{"loc":2738,"attributed_loc":0},"2021-06":{"loc":7198,"attributed_loc":0},"2021-07":{"loc":1133,"attributed_loc":0},"2021-08":{"loc":6244,"attributed_loc":0},"2021-09":{"loc":2550,"attributed_loc":0},"2021-10":{"loc":8247,"attributed_loc":0},"2021-11":{"loc":4004,"attributed_loc":0},"2021-12":{"loc":2819,"attributed_loc":0},"2022-01":{"loc":4764,"attributed_loc":0},"2022-02":{"loc":15058,"attributed_loc":0},"2022-03":{"loc":4709,"attributed_loc":0},"2022-04":{"loc":3668,"attributed_loc":0},"2022-05":{"loc":898,"attributed_loc":0},"2022-06":{"loc":3723,"attributed_loc":0},"2022-07":{"loc":3659,"attributed_loc":0},"2022-08":{"loc":2853,"attributed_loc":0},"2022-09":{"loc":5689,"attributed_loc":0},"2022-10":{"loc":4641,"attributed_loc":0},"2022-11":{"loc":5967,"attributed_loc":0},"2022-12":{"loc":435,"attributed_loc":0},"2023-01":{"loc":4103,"attributed_loc":0},"2023-02":{"loc":3528,"attributed_loc":0},"2023-03":{"loc":1457,"attributed_loc":0},"2023-04":{"loc":4101,"attributed_loc":0},"2023-05":{"loc":3127,"attributed_loc":0},"2023-06":{"loc":4349,"attributed_loc":0},"2023-07":{"loc":2086,"attributed_loc":0},"2023-08":{"loc":6146,"attributed_loc":0},"2023-09":{"loc":3740,"attributed_loc":0},"2023-10":{"loc":5672,"attributed_loc":0},"2023-11":{"loc":1908,"attributed_loc":0},"2023-12":{"loc":5534,"attributed_loc":0},"2024-01":{"loc":1666,"attributed_loc":0},"2024-02":{"loc":4041,"attributed_loc":0},"2024-03":{"loc":919,"attributed_loc":0},"2024-04":{"loc":868,"attributed_loc":0},"2024-05":{"loc":3289,"attributed_loc":0},"2024-06":{"loc":2948,"attributed_loc":0},"2024-07":{"loc":3822,"attributed_loc":0},"2024-08":{"loc":6148,"attributed_loc":0},"2024-09":{"loc":54059,"attributed_loc":0},"2024-10":{"loc":5008,"attributed_loc":0},"2024-11":{"loc":5423,"attributed_loc":0},"2024-12":{"loc":8128,"attributed_loc":0},"2025-01":{"loc":1479,"attributed_loc":0},"2025-02":{"loc":5852,"attributed_loc":0},"2025-03":{"loc":821,"attributed_loc":0},"2025-04":{"loc":1868,"attributed_loc":0},"2025-05":{"loc":2533,"attributed_loc":0},"2025-06":{"loc":975,"attributed_loc":0},"2025-07":{"loc":4953,"attributed_loc":0},"2025-08":{"loc":1305,"attributed_loc":0},"2025-09":{"loc":1231,"attributed_loc":0},"2025-10":{"loc":3495,"attributed_loc":0},"2025-11":{"loc":1849,"attributed_loc":0},"2025-12":{"loc":2753,"attributed_loc":0},"2026-01":{"loc":962,"attributed_loc":0},"2026-02":{"loc":3301,"attributed_loc":0},"2026-03":{"loc":731,"attributed_loc":0},"2026-04":{"loc":1690,"attributed_loc":0},"2026-05":{"loc":4892,"attributed_loc":0},"2026-06":{"loc":458,"attributed_loc":0},"2026-07":{"loc":2109,"attributed_loc":0},"2026-08":{"loc":4391,"attributed_loc":0},"2026-09":{"loc":2762,"attributed_loc":0},"2026-10":{"loc":483,"attributed_loc":0},"2026-11":{"loc":559,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"work_units":2943.0,"flagged_units":3.0,"pre_ai_era_bursts":2.0,"pre_ai_era_measured_loc":153315.0,"pre_ai_era_burst_loc":5147.0,"measured_loc":372748.0,"flagged_loc":9418.0,"flagged_loc_share":0.02526639981971734,"max_loc_per_hour":10656.0,"median_loc_per_hour":59.99359111301004,"pr_timed_units":247.0,"excluded_import_loc":67055.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"5,328 lines of first-party code in ~0.5h (10,656 lines/hour, PR #3258)","ref":"da0dc7292cda2302d1d430392524af2f80b40a2a","url":"https://github.com/BookStackApp/BookStack/commit/da0dc7292cda2302d1d430392524af2f80b40a2a","weight":0.6},{"kind":"velocity-burst","description":"3,080 lines of first-party code in ~0.5h (6,160 lines/hour, 1 commit session)","ref":"db4093d523352a29cabddd79ad40262f6fa1b5c6","url":"https://github.com/BookStackApp/BookStack/commit/db4093d523352a29cabddd79ad40262f6fa1b5c6","weight":0.6},{"kind":"velocity-burst","description":"1,010 lines of first-party code in ~1.2h (828 lines/hour, 1 commit session)","ref":"c519f707e82693cfe6d392c04dd8e2efaeca24ca","url":"https://github.com/BookStackApp/BookStack/commit/c519f707e82693cfe6d392c04dd8e2efaeca24ca","weight":0.2483606557377049}],"data":{"flagged_loc_by_commit":{"db4093d523352a29cabddd79ad40262f6fa1b5c6":3080,"da0dc7292cda2302d1d430392524af2f80b40a2a":5328,"c519f707e82693cfe6d392c04dd8e2efaeca24ca":1010},"excluded_import_commits":["03f6be6d0ebec7b91fbda407a77e7028767e4865","22d078b47f5bd024da98432c7db745d953291712","2be504e0d20aa7c95b1fe006f675928faf0bd1a9","eaa1765c7a68cd671bcb37a666203210bf05d217","f3a7d5881671d401101032bee76a4196b11f4bf6"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"releases":0.0,"flagged_releases":0.0,"max_loc_per_day":0.0},"findings":[],"evidence":[],"data":{"releases":[]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":217367.0,"index":0.009,"count:narrated_steps":2.0,"per_kloc:narrated_steps":0.009,"files:narrated_steps":2.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Now we will clear the users out of memory so they are no longer available","ref":"app/Access/Guards/ExternalBaseSessionGuard.php:191","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/app/Access/Guards/ExternalBaseSessionGuard.php#L191","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Now we process each of the unique target nodes, attempting","ref":"resources/js/wysiwyg/lexical/core/LexicalMutations.ts:215","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/resources/js/wysiwyg/lexical/core/LexicalMutations.ts#L215","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":2.0,"secrets_low_confidence":2.0},"findings":[{"rule_id":"gitleaks/private-key","severity":"low","message":"Possible private-key secret in the current tree (test/docs/example file)","path":"tests/Helpers/OidcJwtHelper.php","line":92,"fingerprint":"tests/Helpers/OidcJwtHelper.php:private-key:92"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit b5638a1c72); removed from the current tree but still retrievable","path":"public/dist/wysiwyg.js","line":12,"fingerprint":"b5638a1c72f483c1cab535a78dcdb2977b5dc106:public/dist/wysiwyg.js:generic-api-key:12"},{"rule_id":"gitleaks/private-key","severity":"low","message":"Possible private-key secret in history (commit f3d54e4a2d); removed from the current tree but still retrievable","path":"tests/Unit/OpenIdConnectIdTokenTest.php","line":77,"fingerprint":"f3d54e4a2dd0fe22f5c2e44f878d1bc6757aa230:tests/Unit/OpenIdConnectIdTokenTest.php:private-key:77"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit db3acabc66); removed from the current tree but still retrievable","path":"config/app.php","line":81,"fingerprint":"db3acabc662e976f253db47f82162c9f00667446:config/app.php:generic-api-key:81"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":111.0,"findings_high":74.0,"findings_medium":37.0,"findings_low":0.0,"weighted_findings":64.75,"scanned_lines":217362.0,"parse_errors":5.0},"findings":[{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"app/Access/Guards/ExternalBaseSessionGuard.php","line":220,"fingerprint":"php.lang.security.weak-crypto:app/Access/Guards/ExternalBaseSessionGuard.php:220"},{"rule_id":"opengrep/php.laravel.security.laravel-dangerous-model-construction","severity":"high","message":"Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections. [confidence low]","path":"app/Activity/Models/Watch.php","line":26,"fingerprint":"php.laravel.security.laravel-dangerous-model-construction:app/Activity/Models/Watch.php:26"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"app/App/helpers.php","line":23,"fingerprint":"php.lang.security.weak-crypto:app/App/helpers.php:23"},{"rule_id":"opengrep/php.laravel.security.laravel-cookie-secure-set","severity":"high","message":"Found a configuration file where the secure attribute is not set to 'true'. Setting 'secure' to 'true' prevents the client from transmitting the cookie over unencrypted channels and therefore prevents cookies from being stolen through man in the middle attacks. [confidence low]","path":"app/Config/session.php","line":56,"fingerprint":"php.laravel.security.laravel-cookie-secure-set:app/Config/session.php:56"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"app/Entities/Tools/PageContent.php","line":361,"fingerprint":"php.lang.security.weak-crypto:app/Entities/Tools/PageContent.php:361"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"app/Entities/Tools/SlugGenerator.php","line":55,"fingerprint":"php.lang.security.weak-crypto:app/Entities/Tools/SlugGenerator.php:55"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"app/Theming/CustomHtmlHeadContentProvider.php","line":27,"fingerprint":"php.lang.security.weak-crypto:app/Theming/CustomHtmlHeadContentProvider.php:27"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"app/Theming/CustomHtmlHeadContentProvider.php","line":43,"fingerprint":"php.lang.security.weak-crypto:app/Theming/CustomHtmlHeadContentProvider.php:43"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"app/Theming/ThemeService.php","line":139,"fingerprint":"php.lang.security.weak-crypto:app/Theming/ThemeService.php:139"},{"rule_id":"opengrep/php.lang.security.weak-crypto","severity":"high","message":"Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]","path":"app/Uploads/UserAvatars.php","line":108,"fingerprint":"php.lang.security.weak-crypto:app/Uploads/UserAvatars.php:108"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/code/index.mjs","line":64,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/code/index.mjs:64"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `elem.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/code/index.mjs","line":64,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/code/index.mjs:64"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/ajax-form.js","line":66,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/ajax-form.js:66"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.responseContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/ajax-form.js","line":66,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/ajax-form.js:66"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/ajax-form.js","line":71,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/ajax-form.js:71"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.responseContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/ajax-form.js","line":71,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/ajax-form.js:71"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/attachments.js","line":64,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/attachments.js:64"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.listPanel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/attachments.js","line":64,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/attachments.js:64"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/attachments.js","line":80,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/attachments.js:80"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.editContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/attachments.js","line":80,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/attachments.js:80"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/auto-suggest.js","line":116,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/auto-suggest.js:116"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/auto-suggest.js","line":116,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/auto-suggest.js:116"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/code-editor.js","line":203,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/code-editor.js:203"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.historyList.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/code-editor.js","line":203,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/code-editor.js:203"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/dropdown-search.js","line":57,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/dropdown-search.js:57"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.listContainerElem.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/dropdown-search.js","line":57,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/dropdown-search.js:57"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/entity-search.js","line":44,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/entity-search.js:44"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.searchResults.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/entity-search.js","line":44,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/entity-search.js:44"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/entity-selector.ts","line":141,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/entity-selector.ts:141"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.resultsContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/entity-selector.ts","line":141,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/entity-selector.ts:141"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/entity-selector.ts","line":159,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/entity-selector.ts:159"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.resultsContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/entity-selector.ts","line":159,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/entity-selector.ts:159"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/image-manager.js","line":187,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/image-manager.js:187"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/image-manager.js","line":187,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/image-manager.js:187"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/image-manager.js","line":192,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/image-manager.js:192"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.loadMore.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/image-manager.js","line":192,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/image-manager.js:192"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/image-manager.js","line":274,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/image-manager.js:274"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.formContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/image-manager.js","line":274,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/image-manager.js:274"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/page-comment-reference.ts","line":122,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/page-comment-reference.ts:122"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `marker.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/page-comment-reference.ts","line":122,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/page-comment-reference.ts:122"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/page-comment-reference.ts","line":202,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/page-comment-reference.ts:202"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `close.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/page-comment-reference.ts","line":202,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/page-comment-reference.ts:202"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/page-editor.js","line":56,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/page-editor.js:56"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.draftDisplay.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/page-editor.js","line":56,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/page-editor.js:56"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/template-manager.js","line":77,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/template-manager.js:77"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/template-manager.js","line":77,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/template-manager.js:77"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/template-manager.js","line":86,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/template-manager.js:86"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/template-manager.js","line":86,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/template-manager.js:86"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/user-select.js","line":17,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/components/user-select.js:17"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.userInfoContainer.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/components/user-select.js","line":17,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/components/user-select.js:17"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/services/dom.ts","line":176,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/services/dom.ts:176"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `wrap.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/services/dom.ts","line":176,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/services/dom.ts:176"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/services/vdom.ts","line":26,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/services/vdom.ts:26"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `contentDom.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/services/vdom.ts","line":26,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/services/vdom.ts:26"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg-tinymce/config.js","line":167,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/wysiwyg-tinymce/config.js:167"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg-tinymce/config.js","line":167,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/wysiwyg-tinymce/config.js:167"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg-tinymce/plugin-codeeditor.js","line":103,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/wysiwyg-tinymce/plugin-codeeditor.js:103"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `tempEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg-tinymce/plugin-codeeditor.js","line":103,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/wysiwyg-tinymce/plugin-codeeditor.js:103"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg-tinymce/plugins-details.js","line":237,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/wysiwyg-tinymce/plugins-details.js:237"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `details.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg-tinymce/plugins-details.js","line":237,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/wysiwyg-tinymce/plugins-details.js:237"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg/ui/decorators/MentionDecorator.ts","line":99,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/wysiwyg/ui/decorators/MentionDecorator.ts:99"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `iconWrap.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg/ui/decorators/MentionDecorator.ts","line":99,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/wysiwyg/ui/decorators/MentionDecorator.ts:99"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg/ui/framework/blocks/color-picker.ts","line":68,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/wysiwyg/ui/framework/blocks/color-picker.ts:68"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `removeButton.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg/ui/framework/blocks/color-picker.ts","line":68,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/wysiwyg/ui/framework/blocks/color-picker.ts:68"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg/ui/framework/blocks/color-picker.ts","line":77,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/wysiwyg/ui/framework/blocks/color-picker.ts:77"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `selectButton.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg/ui/framework/blocks/color-picker.ts","line":77,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/wysiwyg/ui/framework/blocks/color-picker.ts:77"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg/ui/framework/blocks/external-content.ts","line":23,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/wysiwyg/ui/framework/blocks/external-content.ts:23"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `wrapper.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg/ui/framework/blocks/external-content.ts","line":23,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/wysiwyg/ui/framework/blocks/external-content.ts:23"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg/ui/framework/blocks/menu-button.ts","line":10,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/wysiwyg/ui/framework/blocks/menu-button.ts:10"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `icon.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg/ui/framework/blocks/menu-button.ts","line":10,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/wysiwyg/ui/framework/blocks/menu-button.ts:10"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg/ui/framework/buttons.ts","line":64,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/wysiwyg/ui/framework/buttons.ts:64"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `icon.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg/ui/framework/buttons.ts","line":64,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/wysiwyg/ui/framework/buttons.ts:64"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg/ui/framework/modals.ts","line":60,"fingerprint":"javascript.browser.security.insecure-document-method:resources/js/wysiwyg/ui/framework/modals.ts:60"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `closeButton.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"resources/js/wysiwyg/ui/framework/modals.ts","line":60,"fingerprint":"javascript.browser.security.insecure-innerhtml:resources/js/wysiwyg/ui/framework/modals.ts:60"},{"rule_id":"opengrep/php.lang.security.unlink-use","severity":"medium","message":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. [confidence low]","path":"app/Console/Commands/InstallModuleCommand.php","line":255,"fingerprint":"php.lang.security.unlink-use:app/Console/Commands/InstallModuleCommand.php:255"},{"rule_id":"opengrep/php.lang.security.unlink-use","severity":"medium","message":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. [confidence low]","path":"app/Console/Commands/InstallModuleCommand.php","line":264,"fingerprint":"php.lang.security.unlink-use:app/Console/Commands/InstallModuleCommand.php:264"},{"rule_id":"opengrep/php.lang.security.unlink-use","severity":"medium","message":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. [confidence low]","path":"app/Exports/PdfGenerator.php","line":151,"fingerprint":"php.lang.security.unlink-use:app/Exports/PdfGenerator.php:151"},{"rule_id":"opengrep/php.lang.security.unlink-use","severity":"medium","message":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. [confidence low]","path":"app/Exports/ZipExports/ZipExportBuilder.php","line":100,"fingerprint":"php.lang.security.unlink-use:app/Exports/ZipExports/ZipExportBuilder.php:100"},{"rule_id":"opengrep/php.lang.security.unlink-use","severity":"medium","message":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. [confidence low]","path":"app/Exports/ZipExports/ZipExportBuilder.php","line":106,"fingerprint":"php.lang.security.unlink-use:app/Exports/ZipExports/ZipExportBuilder.php:106"},{"rule_id":"opengrep/php.lang.security.unlink-use","severity":"medium","message":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. [confidence low]","path":"app/Exports/ZipExports/ZipExportBuilder.php","line":113,"fingerprint":"php.lang.security.unlink-use:app/Exports/ZipExports/ZipExportBuilder.php:113"},{"rule_id":"opengrep/php.lang.security.unlink-use","severity":"medium","message":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. [confidence low]","path":"app/Exports/ZipExports/ZipImportRunner.php","line":121,"fingerprint":"php.lang.security.unlink-use:app/Exports/ZipExports/ZipImportRunner.php:121"},{"rule_id":"opengrep/php.lang.security.unlink-use","severity":"medium","message":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. [confidence low]","path":"app/Http/DownloadResponseFactory.php","line":51,"fingerprint":"php.lang.security.unlink-use:app/Http/DownloadResponseFactory.php:51"},{"rule_id":"opengrep/php.lang.security.unlink-use","severity":"medium","message":"Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. [confidence low]","path":"app/Theming/ThemeModuleManager.php","line":79,"fingerprint":"php.lang.security.unlink-use:app/Theming/ThemeModuleManager.php:79"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"resources/js/code/languages.js","line":39,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:resources/js/code/languages.js:39"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"resources/js/code/languages.js","line":113,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:resources/js/code/languages.js:113"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"resources/js/components/ajax-form.js","line":64,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:resources/js/components/ajax-form.js:64"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"resources/js/components/auto-suggest.js","line":116,"fingerprint":"javascript.lang.security.html-in-template-string:resources/js/components/auto-suggest.js:116"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"resources/js/components/book-sort.js","line":200,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:resources/js/components/book-sort.js:200"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"resources/js/components/code-editor.js","line":205,"fingerprint":"javascript.lang.security.html-in-template-string:resources/js/components/code-editor.js:205"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"resources/js/markdown/actions.ts","line":115,"fingerprint":"javascript.lang.security.html-in-template-string:resources/js/markdown/actions.ts:115"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"resources/js/markdown/actions.ts","line":141,"fingerprint":"javascript.lang.security.html-in-template-string:resources/js/markdown/actions.ts:141"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"resources/js/markdown/actions.ts","line":344,"fingerprint":"javascript.lang.security.html-in-template-string:resources/js/markdown/actions.ts:344"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"resources/js/markdown/inputs/textarea.ts","line":149,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:resources/js/markdown/inputs/textarea.ts:149"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"resources/js/services/multi-lists.ts","line":61,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:resources/js/services/multi-lists.ts:61"},{"rule_id":"opengrep/javascript.lang.security.audit.incomplete-sanitization","severity":"medium","message":"``\nhtml, body, html.dark-mode {\n    background: ${options.darkMode ? '#222' : '#fff'};\n} \nbody {\n    padding-left: 15px !important;\n    padding-right: 15px !important; \n    height: initial !important;\n    margin:0!important; \n    margin-left: auto! important;\n    margin-right: auto !important;\n    o [confidence low]","path":"resources/js/wysiwyg-tinymce/config.js","line":222,"fingerprint":"javascript.lang.security.audit.incomplete-sanitization:resources/js/wysiwyg-tinymce/config.js:222"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"resources/js/wysiwyg-tinymce/drop-paste-handling.js","line":50,"fingerprint":"javascript.lang.security.html-in-template-string:resources/js/wysiwyg-tinymce/drop-paste-handling.js:50"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"resources/js/wysiwyg-tinymce/drop-paste-handling.js","line":54,"fingerprint":"javascript.lang.security.html-in-template-string:resources/js/wysiwyg-tinymce/drop-paste-handling.js:54"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"resources/js/wysiwyg-tinymce/fixes.js","line":155,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:resources/js/wysiwyg-tinymce/fixes.js:155"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"resources/js/wysiwyg-tinymce/plugin-drawio.js","line":30,"fingerprint":"javascript.lang.security.html-in-template-string:resources/js/wysiwyg-tinymce/plugin-drawio.js:30"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"resources/js/wysiwyg-tinymce/plugin-drawio.js","line":69,"fingerprint":"javascript.lang.security.html-in-template-string:resources/js/wysiwyg-tinymce/plugin-drawio.js:69"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"resources/js/wysiwyg-tinymce/plugin-drawio.js","line":109,"fingerprint":"javascript.lang.security.html-in-template-string:resources/js/wysiwyg-tinymce/plugin-drawio.js:109"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"resources/js/wysiwyg-tinymce/plugins-imagemanager.js","line":15,"fingerprint":"javascript.lang.security.html-in-template-string:resources/js/wysiwyg-tinymce/plugins-imagemanager.js:15"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"resources/js/wysiwyg-tinymce/plugins-imagemanager.js","line":16,"fingerprint":"javascript.lang.security.html-in-template-string:resources/js/wysiwyg-tinymce/plugins-imagemanager.js:16"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"resources/js/wysiwyg/lexical/rich-text/LexicalMediaNode.ts","line":349,"fingerprint":"javascript.lang.security.html-in-template-string:resources/js/wysiwyg/lexical/rich-text/LexicalMediaNode.ts:349"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"resources/js/wysiwyg/lexical/utils/index.ts","line":142,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:resources/js/wysiwyg/lexical/utils/index.ts:142"},{"rule_id":"opengrep/php.laravel.security.laravel-blade-form-missing-csrf","severity":"medium","message":"Detected a form executing a state-changing HTTP method `POST` to route definition `{{ $bookshelf?->getUrl('/create-book') ?? url('/books') }}` without a Laravel CSRF decorator or explicit CSRF token implementation. If this form modifies sensitive state this will open your application to Cross-Site R [confidence low]","path":"resources/views/books/create.blade.php","line":30,"fingerprint":"php.laravel.security.laravel-blade-form-missing-csrf:resources/views/books/create.blade.php:30"},{"rule_id":"opengrep/php.laravel.security.laravel-blade-form-missing-csrf","severity":"medium","message":"Detected a form executing a state-changing HTTP method `POST` to route definition `{{ $book->getUrl() }}` without a Laravel CSRF decorator or explicit CSRF token implementation. If this form modifies sensitive state this will open your application to Cross-Site Request Forgery (CSRF) attacks. [confidence low]","path":"resources/views/books/edit.blade.php","line":19,"fingerprint":"php.laravel.security.laravel-blade-form-missing-csrf:resources/views/books/edit.blade.php:19"},{"rule_id":"opengrep/php.laravel.security.laravel-blade-form-missing-csrf","severity":"medium","message":"Detected a form executing a state-changing HTTP method `POST` to route definition `{{ $book->getUrl('/create-chapter') }}` without a Laravel CSRF decorator or explicit CSRF token implementation. If this form modifies sensitive state this will open your application to Cross-Site Request Forgery (CSRF [confidence low]","path":"resources/views/chapters/create.blade.php","line":18,"fingerprint":"php.laravel.security.laravel-blade-form-missing-csrf:resources/views/chapters/create.blade.php:18"},{"rule_id":"opengrep/php.laravel.security.laravel-blade-form-missing-csrf","severity":"medium","message":"Detected a form executing a state-changing HTTP method `POST` to route definition `{{  $chapter->getUrl() }}` without a Laravel CSRF decorator or explicit CSRF token implementation. If this form modifies sensitive state this will open your application to Cross-Site Request Forgery (CSRF) attacks. [confidence low]","path":"resources/views/chapters/edit.blade.php","line":20,"fingerprint":"php.laravel.security.laravel-blade-form-missing-csrf:resources/views/chapters/edit.blade.php:20"},{"rule_id":"opengrep/php.laravel.security.laravel-blade-form-missing-csrf","severity":"medium","message":"Detected a form executing a state-changing HTTP method `POST` to route definition `{{ url(` without a Laravel CSRF decorator or explicit CSRF token implementation. If this form modifies sensitive state this will open your application to Cross-Site Request Forgery (CSRF) attacks. [confidence low]","path":"resources/views/shelves/create.blade.php","line":22,"fingerprint":"php.laravel.security.laravel-blade-form-missing-csrf:resources/views/shelves/create.blade.php:22"},{"rule_id":"opengrep/php.laravel.security.laravel-blade-form-missing-csrf","severity":"medium","message":"Detected a form executing a state-changing HTTP method `POST` to route definition `{{ $shelf->getUrl() }}` without a Laravel CSRF decorator or explicit CSRF token implementation. If this form modifies sensitive state this will open your application to Cross-Site Request Forgery (CSRF) attacks. [confidence low]","path":"resources/views/shelves/edit.blade.php","line":19,"fingerprint":"php.laravel.security.laravel-blade-form-missing-csrf:resources/views/shelves/edit.blade.php:19"}],"evidence":[],"data":{"rulesets":["php","typescript","javascript","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":6.0,"vulnerabilities":6.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":5.0,"vulns_low":1.0,"vulns_unknown":0.0,"penalty":16.0},"findings":[{"rule_id":"osv/GHSA-gcqx-w48m-w2h4","severity":"medium","message":"deepmerge@4.3.1 (npm) is affected by GHSA-gcqx-w48m-w2h4","path":"package-lock.json","line":null,"fingerprint":"deepmerge@4.3.1 (npm):GHSA-gcqx-w48m-w2h4"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@10.5.0 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"package-lock.json","line":null,"fingerprint":"glob@10.5.0 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@13.0.6 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"package-lock.json","line":null,"fingerprint":"glob@13.0.6 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.6 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@10.2.6 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.9 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.9 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-63hm-g96r-2m2q","severity":"low","message":"laravel/framework@v13.35.0 (Packagist) is affected by GHSA-63hm-g96r-2m2q","path":"composer.lock","line":null,"fingerprint":"laravel/framework@v13.35.0 (Packagist):GHSA-63hm-g96r-2m2q"}],"evidence":[],"data":{"ecosystems":["Packagist","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.925,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":6308.0,"function_nloc":61395.0,"mean_ccn":2.36,"p90_ccn":5.0,"complex_functions":74.0,"long_functions":22.0,"many_param_functions":1.0,"risky_nloc_share":0.1117},"findings":[],"evidence":[{"kind":"complex-function","description":"insertText in resources/js/wysiwyg/lexical/core/LexicalSelection.ts: complexity 91, 287 lines","ref":"resources/js/wysiwyg/lexical/core/LexicalSelection.ts","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/resources/js/wysiwyg/lexical/core/LexicalSelection.ts#L717","weight":1.0},{"kind":"complex-function","description":"$handleArrowKey in resources/js/wysiwyg/lexical/table/LexicalTableSelectionHelpers.ts: complexity 62, 281 lines","ref":"resources/js/wysiwyg/lexical/table/LexicalTableSelectionHelpers.ts","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/resources/js/wysiwyg/lexical/table/LexicalTableSelectionHelpers.ts#L1267","weight":1.0},{"kind":"complex-function","description":"(anonymous) in resources/js/wysiwyg/lexical/core/LexicalEvents.ts: complexity 56, 191 lines","ref":"resources/js/wysiwyg/lexical/core/LexicalEvents.ts","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/resources/js/wysiwyg/lexical/core/LexicalEvents.ts#L542","weight":0.9333333333333333},{"kind":"complex-function","description":"updateDOMSelection in resources/js/wysiwyg/lexical/core/LexicalSelection.ts: complexity 47, 144 lines","ref":"resources/js/wysiwyg/lexical/core/LexicalSelection.ts","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/resources/js/wysiwyg/lexical/core/LexicalSelection.ts#L2558","weight":0.7833333333333333},{"kind":"complex-function","description":"(anonymous) in resources/js/wysiwyg/lexical/core/LexicalMutations.ts: complexity 45, 136 lines","ref":"resources/js/wysiwyg/lexical/core/LexicalMutations.ts","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/resources/js/wysiwyg/lexical/core/LexicalMutations.ts#L111","weight":0.75},{"kind":"complex-function","description":"$patchStyleText in resources/js/wysiwyg/lexical/selection/lexical-node.ts: complexity 44, 119 lines","ref":"resources/js/wysiwyg/lexical/selection/lexical-node.ts","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/resources/js/wysiwyg/lexical/selection/lexical-node.ts#L279","weight":0.7333333333333333},{"kind":"complex-function","description":"deleteCharacter in resources/js/wysiwyg/lexical/core/LexicalSelection.ts: complexity 41, 92 lines","ref":"resources/js/wysiwyg/lexical/core/LexicalSelection.ts","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/resources/js/wysiwyg/lexical/core/LexicalSelection.ts#L1594","weight":0.6833333333333333},{"kind":"complex-function","description":"(anonymous) in resources/js/wysiwyg/lexical/table/LexicalTableSelectionHelpers.ts: complexity 41, 129 lines","ref":"resources/js/wysiwyg/lexical/table/LexicalTableSelectionHelpers.ts","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/resources/js/wysiwyg/lexical/table/LexicalTableSelectionHelpers.ts#L675","weight":0.6833333333333333},{"kind":"complex-function","description":"$wrapNodesImpl in resources/js/wysiwyg/lexical/selection/range-selection.ts: complexity 37, 137 lines","ref":"resources/js/wysiwyg/lexical/selection/range-selection.ts","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/resources/js/wysiwyg/lexical/selection/range-selection.ts#L200","weight":0.6166666666666667},{"kind":"complex-function","description":"onKeyDown in resources/js/wysiwyg/lexical/core/LexicalEvents.ts: complexity 34, 97 lines","ref":"resources/js/wysiwyg/lexical/core/LexicalEvents.ts","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/resources/js/wysiwyg/lexical/core/LexicalEvents.ts#L992","weight":0.5666666666666667}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":164572.0,"duplicated_lines":25539.0,"duplicated_share":0.1552,"files":1981.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: app/Access/Controllers/MfaBackupCodesController.php:62 and app/Access/Controllers/MfaTotpController.php:74","ref":"app/Access/Controllers/MfaBackupCodesController.php","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/app/Access/Controllers/MfaBackupCodesController.php#L62","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/Access/Guards/AsyncExternalBaseSessionGuard.php:15 and app/Access/Guards/ExternalBaseSessionGuard.php:135","ref":"app/Access/Guards/AsyncExternalBaseSessionGuard.php","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/app/Access/Guards/AsyncExternalBaseSessionGuard.php#L15","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/Activity/Controllers/WebhookController.php:61 and app/Activity/Controllers/WebhookController.php:99","ref":"app/Activity/Controllers/WebhookController.php","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/app/Activity/Controllers/WebhookController.php#L61","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/Activity/Notifications/Messages/CommentCreationNotification.php:14 and app/Activity/Notifications/Messages/CommentMentionNotification.php:14","ref":"app/Activity/Notifications/Messages/CommentCreationNotification.php","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/app/Activity/Notifications/Messages/CommentCreationNotification.php#L14","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/Activity/Notifications/Messages/PageCreationNotification.php:13 and app/Activity/Notifications/Messages/PageUpdateNotification.php:13","ref":"app/Activity/Notifications/Messages/PageCreationNotification.php","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/app/Activity/Notifications/Messages/PageCreationNotification.php#L13","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/Entities/Controllers/BookApiController.php:143 and app/Entities/Controllers/BookshelfApiController.php:127","ref":"app/Entities/Controllers/BookApiController.php","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/app/Entities/Controllers/BookApiController.php#L143","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/Entities/Controllers/BookController.php:93 and app/Entities/Controllers/BookController.php:172","ref":"app/Entities/Controllers/BookController.php","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/app/Entities/Controllers/BookController.php#L93","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/Entities/Controllers/PageController.php:282 and app/Entities/Controllers/PageController.php:307","ref":"app/Entities/Controllers/PageController.php","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/app/Entities/Controllers/PageController.php#L282","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/Entities/Queries/BookQueries.php:58 and app/Entities/Queries/BookshelfQueries.php:63","ref":"app/Entities/Queries/BookQueries.php","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/app/Entities/Queries/BookQueries.php#L58","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/Entities/Repos/BaseRepo.php:51 and app/Entities/Repos/BaseRepo.php:86","ref":"app/Entities/Repos/BaseRepo.php","url":"https://github.com/BookStackApp/BookStack/blob/0b6b667e0d84ebb3406de6de9fadbf4230c29c0b/app/Entities/Repos/BaseRepo.php#L51","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":14.0,"weighted_findings":5.75,"scanned_lines":217362.0,"category:correctness":14.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"resources/js/components/auto-suggest.js","line":96,"fingerprint":"javascript.lang.correctness.no-stringify-keys:resources/js/components/auto-suggest.js:96"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"resources/js/components/auto-suggest.js","line":97,"fingerprint":"javascript.lang.correctness.no-stringify-keys:resources/js/components/auto-suggest.js:97"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"resources/js/components/auto-suggest.js","line":101,"fingerprint":"javascript.lang.correctness.no-stringify-keys:resources/js/components/auto-suggest.js:101"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dev/docker/db-testing/run.sh","line":32,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dev/docker/db-testing/run.sh:32"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dev/docker/db-testing/run.sh","line":52,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dev/docker/db-testing/run.sh:52"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dev/docker/db-testing/run.sh","line":53,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dev/docker/db-testing/run.sh:53"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dev/docker/db-testing/run.sh","line":58,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dev/docker/db-testing/run.sh:58"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dev/docker/db-testing/run.sh","line":59,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dev/docker/db-testing/run.sh:59"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dev/docker/db-testing/run.sh","line":68,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dev/docker/db-testing/run.sh:68"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dev/docker/db-testing/run.sh","line":69,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dev/docker/db-testing/run.sh:69"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dev/docker/db-testing/run.sh","line":70,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dev/docker/db-testing/run.sh:70"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dev/docker/db-testing/run.sh","line":79,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dev/docker/db-testing/run.sh:79"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dev/docker/db-testing/run.sh","line":80,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dev/docker/db-testing/run.sh:80"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"resources/js/wysiwyg-tinymce/config.js","line":224,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:resources/js/wysiwyg-tinymce/config.js:224"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.512,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":55649.0,"source_lines":217367.0,"test_ratio":0.256,"ci_files":0.0,"cochange_share":0.5044,"cochange_commits":228.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":142.0},"findings":[],"evidence":[{"kind":"docs","description":"readme.md","ref":"readme.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":151.0,"escapes_per_kloc":3.113},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.json","ref":"tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null}],"flags":[]}