{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:04.102565Z","repo":{"ref":{"host":"github.com","owner":"dtt-git","name":"stash-battle"},"default_branch":"main","clone_url":"https://github.com/dtt-git/stash-battle.git","html_url":"https://github.com/dtt-git/stash-battle","description":"A head-to-head scene comparison plugin for Stash that uses a ELO rating system to help you rank your scenes.","stars":4,"forks":3,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":9948,"primary_language":"TypeScript","license_spdx":"AGPL-3.0","created_at":"2026-01-08T04:53:15Z","pushed_at":"2026-10-28T15:22:05Z","security_policy_url":null,"distribution":{"owner_created_at":"2022-01-12T02:09:11Z","owner_type":"User","release_assets":[]}},"commit_sha":"1b5ab94c133b5ec3c54c49f504da3416086eefc4","profile":{"lines_by_language":{"TypeScript":9602,"JavaScript":6685,"Shell":69},"files_by_category":{"source":47,"binary":13,"test":10,"config":6,"docs":6,"other":2,"generated":1},"source_lines":15126,"test_lines":1230},"pillars":{"ai_provenance":{"score":68.0,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.6801,"suspected_share":0.1763,"estimated_share":0.6801,"ai_artifacts":0.0,"flagged_work_units":6.0,"flagged_releases":null,"style_index":7.173},"summary":"Explicit AI attribution on 68% of first-party code added; an estimated 68% including velocity signals."},"quality":{"score":55.4,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":56.5,"duplication":18.0,"lint":69.2,"testing":47.8,"docs":85.0,"type_safety":100.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.08, no CI test run detected; 19% of function code in complex or long functions; 29% duplicated lines. Weakest area: duplication."},"security":{"score":54.5,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":2.8,"dependencies":95.1,"ci_actions":29.5,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 1 known vulnerabilities in 1 dependencies; 126 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":4.0,"checked":4.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":100.0,"attributed_commits":63.0,"attributed_commit_share":0.63,"effective_loc":24552.0,"attributed_loc":16697.0,"attributed_loc_share":0.6800667970022809,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 60 attributed commits, 16,369 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Cursor agent: 3 attributed commits, 328 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2463a27ced49517d39c31ea1d888682ed57538ed","url":"https://github.com/dtt-git/stash-battle/commit/2463a27ced49517d39c31ea1d888682ed57538ed","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"82e5e5f5dc61535abfa2672e5561da39dd0f0176","url":"https://github.com/dtt-git/stash-battle/commit/82e5e5f5dc61535abfa2672e5561da39dd0f0176","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c1700d86c5f9bca3e6635b892bd4f9abab77ed7e","url":"https://github.com/dtt-git/stash-battle/commit/c1700d86c5f9bca3e6635b892bd4f9abab77ed7e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b3c8aedf193fc178046360f12e7b54c2a6c8a3de","url":"https://github.com/dtt-git/stash-battle/commit/b3c8aedf193fc178046360f12e7b54c2a6c8a3de","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"56ab89b66328bd34cdc354662378348b6b429781","url":"https://github.com/dtt-git/stash-battle/commit/56ab89b66328bd34cdc354662378348b6b429781","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"603b30813af4305a5d90f048accfa7e79f1aaf16","url":"https://github.com/dtt-git/stash-battle/commit/603b30813af4305a5d90f048accfa7e79f1aaf16","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ef25b8633b5fcb834ab4117902e81c7362f66da0","url":"https://github.com/dtt-git/stash-battle/commit/ef25b8633b5fcb834ab4117902e81c7362f66da0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"0ca23c1de5e17cba28a7f35121bc88fcd71b4deb","url":"https://github.com/dtt-git/stash-battle/commit/0ca23c1de5e17cba28a7f35121bc88fcd71b4deb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"116a3dd6771ab1c6304ad46c1b27448724bf57a2","url":"https://github.com/dtt-git/stash-battle/commit/116a3dd6771ab1c6304ad46c1b27448724bf57a2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7b2e21647cae748b1fd2af0c6bf408f0e70f10a4","url":"https://github.com/dtt-git/stash-battle/commit/7b2e21647cae748b1fd2af0c6bf408f0e70f10a4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"bc16d1a017a9f48ef19cbad09e9f9b1b76cabfbe","url":"https://github.com/dtt-git/stash-battle/commit/bc16d1a017a9f48ef19cbad09e9f9b1b76cabfbe","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b69bbdf88da1a200de5adf9b62b2adb4d4186210","url":"https://github.com/dtt-git/stash-battle/commit/b69bbdf88da1a200de5adf9b62b2adb4d4186210","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"450ee95c4835f116a62b0686302382d7c67666af","url":"https://github.com/dtt-git/stash-battle/commit/450ee95c4835f116a62b0686302382d7c67666af","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c3f7f3d360a1ff5adff257dcbedb09a8b77d0e7d","url":"https://github.com/dtt-git/stash-battle/commit/c3f7f3d360a1ff5adff257dcbedb09a8b77d0e7d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6bc2c864d811dc0777257b18c4ecdedaf3f0664a","url":"https://github.com/dtt-git/stash-battle/commit/6bc2c864d811dc0777257b18c4ecdedaf3f0664a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4a389e19ae426b4a2284f916982f69eba36ffd91","url":"https://github.com/dtt-git/stash-battle/commit/4a389e19ae426b4a2284f916982f69eba36ffd91","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"52eda0aaef097cebadb348ac9140fa22f85d245d","url":"https://github.com/dtt-git/stash-battle/commit/52eda0aaef097cebadb348ac9140fa22f85d245d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"40bdd416b624aa861a48d993404c2a31724f5890","url":"https://github.com/dtt-git/stash-battle/commit/40bdd416b624aa861a48d993404c2a31724f5890","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"02dd95527a90c607507dcec7fdf6c7bbdccc3c59","url":"https://github.com/dtt-git/stash-battle/commit/02dd95527a90c607507dcec7fdf6c7bbdccc3c59","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3ba7d3ee370338ccfbf0bcd6687a293653157738","url":"https://github.com/dtt-git/stash-battle/commit/3ba7d3ee370338ccfbf0bcd6687a293653157738","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3dc7f7f563df95ecc04203b654b8c0814f360d75","url":"https://github.com/dtt-git/stash-battle/commit/3dc7f7f563df95ecc04203b654b8c0814f360d75","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e19849e4c2e7bd12da003f3313b0ad7a5a84ac9b","url":"https://github.com/dtt-git/stash-battle/commit/e19849e4c2e7bd12da003f3313b0ad7a5a84ac9b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"72dae09043517709bb84ab063f5bd2322a9cf638","url":"https://github.com/dtt-git/stash-battle/commit/72dae09043517709bb84ab063f5bd2322a9cf638","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"881571b2b6cc371d53c6e7cc6d2523ffa66ec608","url":"https://github.com/dtt-git/stash-battle/commit/881571b2b6cc371d53c6e7cc6d2523ffa66ec608","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b6ca7e33a704482291048cca80cf49ff66fd25fe","url":"https://github.com/dtt-git/stash-battle/commit/b6ca7e33a704482291048cca80cf49ff66fd25fe","weight":0.9}],"data":{"attributed_loc_by_commit":{"7f3026b3ef9046febd8d7090f40f53b5c62f9829":4,"3d9c5cd5e011d008fea0661f1bc0823efd5dfebb":324,"06a283f40aff92a21c2f3d095edc5b3ca9ca571f":2384,"727f56e2651e6e99000763b9c2a248feb45eaf35":19,"438aeee5544780ac8623216e9af9a1c895c5ee42":223,"0a68f37a4055e849986569a2bf7250ff1f9d0b57":0,"25ed4b89807b0ecbb9289d449db766bd1351dfa6":0,"c1d3a7497b5d8233a69632d9fec36638bd87db57":0,"d3e740f48ede5f8c9c084ad3bd87209e7a6a19d4":15,"9e74ce2b812b5cc2361137e4a8320b5f207558bd":225,"1faba40d34190780c37fd1dc04cc3ed2bda83c5a":432,"e69a5721308beb3af657c015fd81040542632c4a":1432,"fe2886516447b39e6249bc251fd802dd1090e2ba":90,"0ff49088e708340e7a6eed171b8c9ac4ab17e0d4":0,"eb22adc2764fdfadf09537705de3ac9708f1ed76":984,"cd5ee3dbd3ebe378cf5c9448ca816df7736298c1":1272,"b62c6957b38a67b05c68bd037c3b5a369c3aed7d":0,"b0bacb65dd84e23d616d5513c4f9077f8ea37786":629,"87d608639ab3b56dacf60938f5cf6d3a6e9d4120":265,"f8a65b4aac230a781ac12ad404660619675da71e":0,"a4d62504e80c085b292de9da08345695f23bfda9":269,"06f0e7861a8c5ae43acac8c60f6cc45683d419a0":0,"deb1414ab3beea2127e2f7076bfc932b05a13146":0,"4356ac176be877b3d889d7e18ff57932e85ef943":0,"7dd5101bc99a34667ba70cbf0ff0ef0767a04297":1,"4f56c60bfb73e7cd18969645214434ffca1a98af":0,"30ee305b4f5911268b8d92fbeb11cf04a01784ab":524,"805362ef9968efee8e75994a496ac439cdb2cf56":3,"70fea3940b9cdeede9106741b50ca03f0a8f7919":1,"4ce9c89e2ea7e2e8ec2316da977666531aa3be7b":3,"c352b5297e889014fee3a1c07b2a1db49dcbde31":2947,"de5a05d18997212013ba93ccefd7b0fa13cbfb26":87,"3260af7c64b8f5557902be30a2baf54673e9c720":773,"64876387452d8d1acda5429e209d8f2ce09fd3a2":1031,"8585e30f5eeeff66a62ccda274965cee7a4ba0be":128,"a2b9166b330329515f76e3ce937c255a69340f72":1,"266f255971f35c3f9ad846f2bf74c525d0826c55":0,"fb419f92f67100506b3d6fd59307ff755608afb5":0,"b6ca7e33a704482291048cca80cf49ff66fd25fe":809,"881571b2b6cc371d53c6e7cc6d2523ffa66ec608":0,"72dae09043517709bb84ab063f5bd2322a9cf638":66,"e19849e4c2e7bd12da003f3313b0ad7a5a84ac9b":95,"3dc7f7f563df95ecc04203b654b8c0814f360d75":66,"3ba7d3ee370338ccfbf0bcd6687a293653157738":288,"02dd95527a90c607507dcec7fdf6c7bbdccc3c59":16,"40bdd416b624aa861a48d993404c2a31724f5890":2,"52eda0aaef097cebadb348ac9140fa22f85d245d":8,"4a389e19ae426b4a2284f916982f69eba36ffd91":16,"6bc2c864d811dc0777257b18c4ecdedaf3f0664a":2,"c3f7f3d360a1ff5adff257dcbedb09a8b77d0e7d":0,"b69bbdf88da1a200de5adf9b62b2adb4d4186210":229,"450ee95c4835f116a62b0686302382d7c67666af":5,"bc16d1a017a9f48ef19cbad09e9f9b1b76cabfbe":20,"7b2e21647cae748b1fd2af0c6bf408f0e70f10a4":10,"116a3dd6771ab1c6304ad46c1b27448724bf57a2":264,"0ca23c1de5e17cba28a7f35121bc88fcd71b4deb":65,"ef25b8633b5fcb834ab4117902e81c7362f66da0":53,"603b30813af4305a5d90f048accfa7e79f1aaf16":3,"56ab89b66328bd34cdc354662378348b6b429781":253,"b3c8aedf193fc178046360f12e7b54c2a6c8a3de":0,"c1700d86c5f9bca3e6635b892bd4f9abab77ed7e":9,"82e5e5f5dc61535abfa2672e5561da39dd0f0176":352,"2463a27ced49517d39c31ea1d888682ed57538ed":0},"tools":{"cursor":{"name":"Cursor agent","commits":3,"loc":328,"first_seen":1782665322,"last_seen":1792697591},"claude-code":{"name":"Claude Code","commits":60,"loc":16369,"first_seen":1792693339,"last_seen":1793199840}},"monthly":{"2026-01":{"loc":3057,"attributed_loc":0},"2026-02":{"loc":84,"attributed_loc":0},"2026-03":{"loc":292,"attributed_loc":0},"2026-05":{"loc":27,"attributed_loc":0},"2026-06":{"loc":4723,"attributed_loc":328},"2026-10":{"loc":16369,"attributed_loc":16369}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":40.0,"flagged_units":6.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":24552.0,"flagged_loc":15372.0,"flagged_loc_share":0.626099706744868,"max_loc_per_hour":1619.2362093352192,"median_loc_per_hour":157.25,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"1,272 lines of first-party code in ~0.8h (1,619 lines/hour, 1 commit session)","ref":"cd5ee3dbd3ebe378cf5c9448ca816df7736298c1","url":"https://github.com/dtt-git/stash-battle/commit/cd5ee3dbd3ebe378cf5c9448ca816df7736298c1","weight":0.48577086280056575},{"kind":"velocity-burst","description":"4,328 lines of first-party code in ~4.0h (1,082 lines/hour, 1 commit session)","ref":"f3df980b9a210086c48fca3dc4a682f0a5a34854","url":"https://github.com/dtt-git/stash-battle/commit/f3df980b9a210086c48fca3dc4a682f0a5a34854","weight":0.3246},{"kind":"velocity-burst","description":"3,807 lines of first-party code in ~4.4h (862 lines/hour, 3 commit session)","ref":"3260af7c64b8f5557902be30a2baf54673e9c720","url":"https://github.com/dtt-git/stash-battle/commit/3260af7c64b8f5557902be30a2baf54673e9c720","weight":0.25863747876957915},{"kind":"velocity-burst","description":"1,160 lines of first-party code in ~1.4h (824 lines/hour, 3 commit session)","ref":"a2b9166b330329515f76e3ce937c255a69340f72","url":"https://github.com/dtt-git/stash-battle/commit/a2b9166b330329515f76e3ce937c255a69340f72","weight":0.247149339120142},{"kind":"velocity-burst","description":"2,626 lines of first-party code in ~4.4h (599 lines/hour, 3 commit session)","ref":"438aeee5544780ac8623216e9af9a1c895c5ee42","url":"https://github.com/dtt-git/stash-battle/commit/438aeee5544780ac8623216e9af9a1c895c5ee42","weight":0.17970345963756182},{"kind":"velocity-burst","description":"2,179 lines of first-party code in ~4.0h (542 lines/hour, 4 commit session)","ref":"fe2886516447b39e6249bc251fd802dd1090e2ba","url":"https://github.com/dtt-git/stash-battle/commit/fe2886516447b39e6249bc251fd802dd1090e2ba","weight":0.1625670074606245}],"data":{"flagged_loc_by_commit":{"f3df980b9a210086c48fca3dc4a682f0a5a34854":4328,"06a283f40aff92a21c2f3d095edc5b3ca9ca571f":2384,"727f56e2651e6e99000763b9c2a248feb45eaf35":19,"438aeee5544780ac8623216e9af9a1c895c5ee42":223,"9e74ce2b812b5cc2361137e4a8320b5f207558bd":225,"1faba40d34190780c37fd1dc04cc3ed2bda83c5a":432,"e69a5721308beb3af657c015fd81040542632c4a":1432,"fe2886516447b39e6249bc251fd802dd1090e2ba":90,"cd5ee3dbd3ebe378cf5c9448ca816df7736298c1":1272,"c352b5297e889014fee3a1c07b2a1db49dcbde31":2947,"de5a05d18997212013ba93ccefd7b0fa13cbfb26":87,"3260af7c64b8f5557902be30a2baf54673e9c720":773,"64876387452d8d1acda5429e209d8f2ce09fd3a2":1031,"8585e30f5eeeff66a62ccda274965cee7a4ba0be":128,"a2b9166b330329515f76e3ce937c255a69340f72":1},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":15126.0,"index":7.173,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":217.0,"per_kloc:emoji_in_code":14.346,"files:emoji_in_code":19.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":370.0,"findings_high":126.0,"findings_medium":240.0,"findings_low":4.0,"weighted_findings":154.75,"scanned_lines":15126.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":1878,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:1878"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `overlay.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":1878,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:1878"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2534,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:2534"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `comparisonArea.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2534,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:2534"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2951,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:2951"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `grid.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2951,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:2951"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2953,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:2953"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `pager.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2953,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:2953"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2980,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:2980"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `status.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2980,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:2980"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3087,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:3087"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `content.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3087,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:3087"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3221,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:3221"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `content.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3221,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:3221"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3435,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:3435"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `histogram.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3435,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:3435"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3438,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:3438"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `scatter.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3438,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:3438"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3467,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:3467"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `tip.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3467,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:3467"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3504,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:3504"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `tip.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3504,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:3504"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3603,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:3603"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `content.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3603,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:3603"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3713,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:3713"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `info.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3713,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:3713"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3733,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:3733"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `status.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3733,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:3733"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3736,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:3736"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `status.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3736,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:3736"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3740,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:3740"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `status.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3740,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:3740"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3742,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:3742"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `status.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3742,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:3742"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3744,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:3744"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `status.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3744,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:3744"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3877,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:3877"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `comparisonArea.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3877,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:3877"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4028,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:4028"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `comparisonArea.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4028,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:4028"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4447,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:4447"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `icon.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4447,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:4447"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4540,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:4540"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `next.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4540,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:4540"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4666,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:4666"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `area.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4666,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:4666"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4761,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:4761"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `area.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4761,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:4761"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4768,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:4768"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `area.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4768,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:4768"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4808,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:4808"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `area.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4808,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:4808"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4829,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:4829"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `area.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4829,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:4829"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":5153,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:5153"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `modal.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":5153,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:5153"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":5324,"fingerprint":"javascript.browser.security.insecure-document-method:plugins/stash-battle/stash-battle.js:5324"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `modal.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":5324,"fingerprint":"javascript.browser.security.insecure-innerhtml:plugins/stash-battle/stash-battle.js:5324"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness.mjs","line":48,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness.mjs:48"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `st.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness.mjs","line":48,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness.mjs:48"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness.mjs","line":49,"fingerprint":"javascript.browser.security.insecure-document-method:scripts/harness.mjs:49"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `pf.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"scripts/harness.mjs","line":49,"fingerprint":"javascript.browser.security.insecure-innerhtml:scripts/harness.mjs:49"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/confirmDialog.ts","line":35,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/confirmDialog.ts:35"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `overlay.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/confirmDialog.ts","line":35,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/confirmDialog.ts:35"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/exploreTab.ts","line":148,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/exploreTab.ts:148"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `grid.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/exploreTab.ts","line":148,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/exploreTab.ts:148"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/exploreTab.ts","line":152,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/exploreTab.ts:152"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `pager.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/exploreTab.ts","line":152,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/exploreTab.ts:152"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/exploreTab.ts","line":195,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/exploreTab.ts:195"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `status.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/exploreTab.ts","line":195,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/exploreTab.ts:195"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/exploreTab.ts","line":317,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/exploreTab.ts:317"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `content.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/exploreTab.ts","line":317,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/exploreTab.ts:317"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":131,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/mainUI.ts:131"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `info.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":131,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/mainUI.ts:131"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":162,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/mainUI.ts:162"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `status.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":162,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/mainUI.ts:162"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":165,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/mainUI.ts:165"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `status.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":165,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/mainUI.ts:165"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":169,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/mainUI.ts:169"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `status.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":169,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/mainUI.ts:169"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":171,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/mainUI.ts:171"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `status.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":171,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/mainUI.ts:171"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":173,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/mainUI.ts:173"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `status.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":173,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/mainUI.ts:173"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":361,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/mainUI.ts:361"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `comparisonArea.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":361,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/mainUI.ts:361"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":544,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/mainUI.ts:544"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `comparisonArea.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/mainUI.ts","line":544,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/mainUI.ts:544"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/modal.ts","line":447,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/modal.ts:447"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `modal.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/modal.ts","line":447,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/modal.ts:447"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/modal.ts","line":678,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/modal.ts:678"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `modal.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/modal.ts","line":678,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/modal.ts:678"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/navButton.ts","line":47,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/navButton.ts:47"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `item.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/navButton.ts","line":47,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/navButton.ts:47"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/navButton.ts","line":166,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/navButton.ts:166"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `link.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/navButton.ts","line":166,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/navButton.ts:166"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/ratingPreview.ts","line":103,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/ratingPreview.ts:103"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `next.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/ratingPreview.ts","line":103,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/ratingPreview.ts:103"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/recordsTab.ts","line":153,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/recordsTab.ts:153"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `content.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/recordsTab.ts","line":153,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/recordsTab.ts:153"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/sceneElo.ts","line":69,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/sceneElo.ts:69"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `item.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/sceneElo.ts","line":69,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/sceneElo.ts:69"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/sceneElo.ts","line":137,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/sceneElo.ts:137"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `icon.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/sceneElo.ts","line":137,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/sceneElo.ts:137"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/screens.ts","line":47,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/screens.ts:47"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `comparisonArea.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/screens.ts","line":47,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/screens.ts:47"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/setupScreen.ts","line":151,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/setupScreen.ts:151"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `area.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/setupScreen.ts","line":151,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/setupScreen.ts:151"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/setupScreen.ts","line":267,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/setupScreen.ts:267"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `area.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/setupScreen.ts","line":267,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/setupScreen.ts:267"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/setupScreen.ts","line":275,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/setupScreen.ts:275"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `area.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/setupScreen.ts","line":275,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/setupScreen.ts:275"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/setupScreen.ts","line":332,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/setupScreen.ts:332"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `area.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/setupScreen.ts","line":332,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/setupScreen.ts:332"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/setupScreen.ts","line":355,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/setupScreen.ts:355"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `area.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/setupScreen.ts","line":355,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/setupScreen.ts:355"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/statsTab.ts","line":313,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/statsTab.ts:313"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `histogram.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/statsTab.ts","line":313,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/statsTab.ts:313"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/statsTab.ts","line":316,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/statsTab.ts:316"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `scatter.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/statsTab.ts","line":316,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/statsTab.ts:316"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/statsTab.ts","line":358,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/statsTab.ts:358"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `tip.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/statsTab.ts","line":358,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/statsTab.ts:358"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/statsTab.ts","line":405,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/statsTab.ts:405"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `tip.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/statsTab.ts","line":405,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/statsTab.ts:405"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/statsTab.ts","line":520,"fingerprint":"javascript.browser.security.insecure-document-method:src/ui/statsTab.ts:520"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `content.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/ui/statsTab.ts","line":520,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/ui/statsTab.ts:520"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":1878,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:1878"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2303,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2303"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2339,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2339"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2342,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2342"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2343,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2343"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2344,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2344"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2348,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2348"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2348,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2348"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2350,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2350"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2351,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2351"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2354,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2354"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2355,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2355"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2356,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2356"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2356,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2356"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2356,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2356"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2358,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2358"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2359,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2359"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2360,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2360"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2361,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2361"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2361,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2361"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2365,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2365"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2367,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2367"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2376,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2376"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2377,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2377"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2424,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2424"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2426,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2426"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2435,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2435"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2437,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2437"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2516,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2516"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2521,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2521"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2555,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2555"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2560,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2560"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2679,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2679"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2683,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2683"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2685,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2685"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2690,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2690"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2692,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2692"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2695,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2695"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2710,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2710"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2714,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2714"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2728,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2728"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2730,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2730"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2901,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2901"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2909,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2909"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2925,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2925"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2939,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2939"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2941,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2941"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2973,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2973"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":2980,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:2980"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3136,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3136"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3138,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3138"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3143,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3143"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3143,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3143"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3252,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3252"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3260,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3260"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3261,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3261"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3298,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3298"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3303,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3303"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3308,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3308"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3309,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3309"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3315,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3315"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3316,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3316"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3318,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3318"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3321,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3321"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3326,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3326"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3327,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3327"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3329,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3329"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3331,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3331"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3335,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3335"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3348,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3348"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3372,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3372"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3373,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3373"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3379,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3379"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3381,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3381"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3382,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3382"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3383,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3383"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3384,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3384"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3385,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3385"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3392,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3392"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3394,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3394"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3395,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3395"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3396,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3396"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3416,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3416"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3424,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3424"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3425,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3425"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3536,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3536"},{"rule_id":"opengrep/javascript.browser.security.raw-html-join","severity":"medium","message":"User controlled data in a HTML string may result in XSS [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3603,"fingerprint":"javascript.browser.security.raw-html-join:plugins/stash-battle/stash-battle.js:3603"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3608,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3608"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3646,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3646"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3713,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3713"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3728,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3728"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3732,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3732"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3733,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3733"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3736,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3736"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3740,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3740"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3744,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3744"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3856,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3856"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":3963,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:3963"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4028,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4028"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4386,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4386"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4388,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4388"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4393,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4393"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4492,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4492"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4499,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4499"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4621,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4621"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4631,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4631"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4639,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4639"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4652,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4652"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4654,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4654"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4656,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4656"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4672,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4672"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4805,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4805"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4808,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4808"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4829,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4829"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4870,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4870"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":4911,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:4911"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":5324,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:5324"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":5382,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:5382"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"plugins/stash-battle/stash-battle.js","line":5398,"fingerprint":"javascript.lang.security.html-in-template-string:plugins/stash-battle/stash-battle.js:5398"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness.mjs","line":48,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness.mjs:48"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/harness.mjs","line":49,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/harness.mjs:49"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/confirmDialog.ts","line":35,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/confirmDialog.ts:35"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/exploreTab.ts","line":94,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/exploreTab.ts:94"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/exploreTab.ts","line":102,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/exploreTab.ts:102"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/exploreTab.ts","line":118,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/exploreTab.ts:118"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/exploreTab.ts","line":134,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/exploreTab.ts:134"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/exploreTab.ts","line":136,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/exploreTab.ts:136"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/exploreTab.ts","line":186,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/exploreTab.ts:186"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/exploreTab.ts","line":195,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/exploreTab.ts:195"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/mainUI.ts","line":61,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/mainUI.ts:61"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/mainUI.ts","line":131,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/mainUI.ts:131"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/mainUI.ts","line":156,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/mainUI.ts:156"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/mainUI.ts","line":161,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/mainUI.ts:161"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/mainUI.ts","line":162,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/mainUI.ts:162"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/mainUI.ts","line":165,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/mainUI.ts:165"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/mainUI.ts","line":169,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/mainUI.ts:169"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/mainUI.ts","line":173,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/mainUI.ts:173"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/mainUI.ts","line":334,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/mainUI.ts:334"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/mainUI.ts","line":463,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/mainUI.ts:463"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/mainUI.ts","line":544,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/mainUI.ts:544"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/miniCard.ts","line":41,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/miniCard.ts:41"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/miniCard.ts","line":44,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/miniCard.ts:44"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/miniCard.ts","line":53,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/miniCard.ts:53"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/miniCard.ts","line":55,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/miniCard.ts:55"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/modal.ts","line":85,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/modal.ts:85"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/modal.ts","line":131,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/modal.ts:131"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/modal.ts","line":678,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/modal.ts:678"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/navButton.ts","line":24,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/navButton.ts:24"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/navButton.ts","line":47,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/navButton.ts:47"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/ratingPreview.ts","line":41,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/ratingPreview.ts:41"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/ratingPreview.ts","line":49,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/ratingPreview.ts:49"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/recordsTab.ts","line":53,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/recordsTab.ts:53"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/recordsTab.ts","line":55,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/recordsTab.ts:55"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/recordsTab.ts","line":60,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/recordsTab.ts:60"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/recordsTab.ts","line":60,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/recordsTab.ts:60"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":20,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:20"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":81,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:81"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":88,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:88"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":89,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:89"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":90,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:90"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":94,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:94"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":94,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:94"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":96,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:96"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":97,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:97"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":100,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:100"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":101,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:101"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":102,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:102"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":102,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:102"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":102,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:102"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":104,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:104"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":105,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:105"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":106,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:106"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":108,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:108"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/ui/sceneCard.ts","line":108,"fingerprint":"javascript.lang.security.html-in-template-string:src/ui/sceneCard.ts:108"}],"evidence":[],"data":{"rulesets":["typescript","javascript","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":1.0,"vulnerabilities":1.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":1.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":3.0},"findings":[{"rule_id":"osv/GHSA-67mh-4wv8-2f99","severity":"medium","message":"esbuild@0.24.2 (npm) is affected by GHSA-67mh-4wv8-2f99","path":"package-lock.json","line":null,"fingerprint":"esbuild@0.24.2 (npm):GHSA-67mh-4wv8-2f99"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":7.0,"findings_high":6.0,"findings_medium":1.0,"findings_low":0.0,"penalty":73.2},"findings":[{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/deploy.yml","line":15,"fingerprint":"excessive-permissions:.github/workflows/deploy.yml:15"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/deploy.yml","line":16,"fingerprint":"excessive-permissions:.github/workflows/deploy.yml:16"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/deploy.yml","line":28,"fingerprint":"template-injection:.github/workflows/deploy.yml:28"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":40,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:40"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/deploy.yml","line":22,"fingerprint":"artipacked:.github/workflows/deploy.yml:22"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.08,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1643.0,"function_nloc":12647.0,"mean_ccn":2.73,"p90_ccn":6.0,"complex_functions":23.0,"long_functions":4.0,"many_param_functions":0.0,"risky_nloc_share":0.1902},"findings":[],"evidence":[{"kind":"complex-function","description":"createSceneCard in plugins/stash-battle/stash-battle.js: complexity 61, 91 lines","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L2315","weight":1.0},{"kind":"complex-function","description":"createSceneCard in src/ui/sceneCard.ts: complexity 61, 112 lines","ref":"src/ui/sceneCard.ts","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/src/ui/sceneCard.ts#L34","weight":1.0},{"kind":"complex-function","description":"openModal in plugins/stash-battle/stash-battle.js: complexity 42, 158 lines","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L5061","weight":0.7},{"kind":"complex-function","description":"openModal in src/ui/modal.ts: complexity 42, 167 lines","ref":"src/ui/modal.ts","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/src/ui/modal.ts#L304","weight":0.7},{"kind":"complex-function","description":"getSceneFilter in plugins/stash-battle/stash-battle.js: complexity 37, 93 lines","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L634","weight":0.6166666666666667},{"kind":"complex-function","description":"getSceneFilter in src/filters.ts: complexity 37, 100 lines","ref":"src/filters.ts","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/src/filters.ts#L115","weight":0.6166666666666667},{"kind":"complex-function","description":"(anonymous) in scripts/harness.mjs: complexity 32, 61 lines","ref":"scripts/harness.mjs","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/scripts/harness.mjs#L219","weight":0.5333333333333333},{"kind":"complex-function","description":"modalKeyHandler in plugins/stash-battle/stash-battle.js: complexity 26, 47 lines","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L5271","weight":0.43333333333333335},{"kind":"complex-function","description":"modalKeyHandler in src/ui/modal.ts: complexity 26, 47 lines","ref":"src/ui/modal.ts","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/src/ui/modal.ts#L600","weight":0.43333333333333335},{"kind":"complex-function","description":"loadNewPair in plugins/stash-battle/stash-battle.js: complexity 25, 92 lines","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L3950","weight":0.4166666666666667}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":11533.0,"duplicated_lines":3294.0,"duplicated_share":0.2856,"files":47.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/stash-battle/stash-battle.js:12 and src/constants.ts:19","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/stash-battle/stash-battle.js:132 and src/score.ts:71","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L132","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/stash-battle/stash-battle.js:318 and src/graphql.ts:52","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L318","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/stash-battle/stash-battle.js:484 and src/ui/deleteDialog.ts:54","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L484","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/stash-battle/stash-battle.js:581 and src/filters.ts:50","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L581","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/stash-battle/stash-battle.js:900 and src/explore.ts:95","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L900","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/stash-battle/stash-battle.js:946 and src/state.ts:70","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L946","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/stash-battle/stash-battle.js:998 and src/cache.ts:17","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L998","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/stash-battle/stash-battle.js:1105 and plugins/stash-battle/stash-battle.js:1164","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L1105","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: plugins/stash-battle/stash-battle.js:1438 and src/settings.ts:68","ref":"plugins/stash-battle/stash-battle.js","url":"https://github.com/dtt-git/stash-battle/blob/1b5ab94c133b5ec3c54c49f504da3416086eefc4/plugins/stash-battle/stash-battle.js#L1438","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":77.0,"weighted_findings":22.25,"scanned_lines":15126.0,"category:correctness":77.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"plugins/stash-battle/stash-battle.js","line":307,"fingerprint":"javascript.lang.correctness.no-stringify-keys:plugins/stash-battle/stash-battle.js:307"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/harness.mjs","line":336,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/harness.mjs:336"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/screenshots.mjs","line":238,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/screenshots.mjs:238"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/graphql.ts","line":22,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/graphql.ts:22"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":321,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:321"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":321,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:321"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":321,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:321"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":321,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:321"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":321,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:321"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":321,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:321"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":345,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:345"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":345,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:345"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":352,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:352"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":352,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:352"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":391,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:391"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":391,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:391"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":537,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:537"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":537,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:537"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":1354,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:1354"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":1354,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:1354"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":1404,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:1404"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":1404,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:1404"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":1405,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:1405"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":1405,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:1405"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":1730,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:1730"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":1730,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:1730"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":2713,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:2713"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":2713,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:2713"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":2713,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:2713"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":2714,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:2714"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":4574,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:4574"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":4575,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:4575"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":4694,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:4694"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":4694,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:4694"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":4694,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:4694"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"plugins/stash-battle/stash-battle.js","line":4695,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:plugins/stash-battle/stash-battle.js:4695"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/harness.mjs","line":25,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/harness.mjs:25"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/harness.mjs","line":25,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/harness.mjs:25"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/harness.mjs","line":333,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/harness.mjs:333"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/harness.mjs","line":333,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/harness.mjs:333"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/screenshots.mjs","line":231,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/screenshots.mjs:231"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/screenshots.mjs","line":231,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/screenshots.mjs:231"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/screenshots.mjs","line":245,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/screenshots.mjs:245"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/screenshots.mjs","line":245,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/screenshots.mjs:245"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/screenshots.mjs","line":245,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/screenshots.mjs:245"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/eloSetup.ts","line":24,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/eloSetup.ts:24"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/eloSetup.ts","line":24,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/eloSetup.ts:24"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/graphql.ts","line":55,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/graphql.ts:55"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/graphql.ts","line":55,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/graphql.ts:55"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/graphql.ts","line":55,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/graphql.ts:55"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/graphql.ts","line":55,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/graphql.ts:55"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/graphql.ts","line":55,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/graphql.ts:55"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/graphql.ts","line":55,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/graphql.ts:55"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/graphql.ts","line":88,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/graphql.ts:88"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/graphql.ts","line":88,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/graphql.ts:88"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/graphql.ts","line":98,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/graphql.ts:98"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/graphql.ts","line":98,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/graphql.ts:98"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/graphql.ts","line":144,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/graphql.ts:144"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/graphql.ts","line":144,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/graphql.ts:144"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/sceneActions.ts","line":15,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/sceneActions.ts:15"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/sceneActions.ts","line":15,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/sceneActions.ts:15"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/settings.ts","line":17,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/settings.ts:17"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/settings.ts","line":17,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/settings.ts:17"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/settings.ts","line":19,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/settings.ts:19"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/settings.ts","line":19,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/settings.ts:19"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/deleteDialog.ts","line":125,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/deleteDialog.ts:125"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/deleteDialog.ts","line":125,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/deleteDialog.ts:125"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/ratingPreview.ts","line":148,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/ratingPreview.ts:148"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/ratingPreview.ts","line":149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/ratingPreview.ts:149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/settingsPanel.ts","line":127,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/settingsPanel.ts:127"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/settingsPanel.ts","line":127,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/settingsPanel.ts:127"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/settingsPanel.ts","line":127,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/settingsPanel.ts:127"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/settingsPanel.ts","line":128,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/settingsPanel.ts:128"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/setupScreen.ts","line":187,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/setupScreen.ts:187"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/setupScreen.ts","line":187,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/setupScreen.ts:187"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/setupScreen.ts","line":187,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/setupScreen.ts:187"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/ui/setupScreen.ts","line":187,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/ui/setupScreen.ts:187"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.1626,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.8767,"test_lines":1230.0,"source_lines":15126.0,"test_ratio":0.0813,"ci_files":1.0,"cochange_share":0.2192,"cochange_commits":73.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/deploy.yml","ref":".github/workflows/deploy.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":1.0,"readme_lines":151.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENCE","ref":"LICENCE","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":7.0,"escapes_per_kloc":0.836},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.json","ref":"tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":12206.0,"other_lines":2920.0,"files_blamed":47.0,"blame_failures":0.0,"quality:ai_findings":74.0,"quality:ai_per_kloc":6.063,"quality:other_findings":3.0,"quality:other_per_kloc":1.027,"quality:ratio":5.9,"security:ai_findings":277.0,"security:ai_per_kloc":22.694,"security:other_findings":23.0,"security:other_per_kloc":7.877,"security:ratio":2.88},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":["unreviewed-ai-risk"]}