Leaderboard github.com
therealMRBK/NextFloor
NextFloor: draw your home in Home Assistant and watch it live in 3D. Free forever – every feature, every furniture pack, no Pro, no shop. Build your own furniture, plugins welcome. No cloud, no account.
AI provenance
87%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
66/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
68/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
87% explicit
Explicit AI attribution on 87% of first-party code added; an estimated 87% including velocity signals.
How the score is built
- Explicitly attributed share87%
- Unattributed share in AI-pace bursts13%
- Estimated AI-generated share87%
- AI tool configuration files1
- Work sessions at AI pace27
- Releases at AI pace9
- Coding-style index (1.0+ means possible)0.77
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 370 | 201,690 | 2026-10-08 | 2026-11-14 |
Lines added per month all AI-attributed share
- 2026-10144,170 · 79% AI
- 2026-1187,461 · 100% AI
Findings in AI-attributed lines vs the rest
From git blame: 85,124 lines trace to AI-attributed commits, 12,389 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 2.26 | 0.65 | 3.49× |
| Security | 2.70 | 5.65 | 0.48× |
Evidence by analyzer
Explicit AI attributionok26 items
- Claude Code: 370 attributed commits, 201,690 lines added
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- attributed_commit_share
- 87.9%
- attributed_commits
- 370
- attributed_loc
- 201,690
- attributed_loc_share
- 87.1%
- commits
- 421
- effective_loc
- 231,631
- tools_detected
- 1
AI tool configurationok1 item
- artifacts
- 1
- earliest_adoption
- 2026-10-08
- tools_configured
- 1
- workflow_agents
- 0
Commit velocityok15 items
- 39,098 lines of first-party code in ~5.6h (6,931 lines/hour, 34 commit session)
- 8,258 lines of first-party code in ~3.2h (2,566 lines/hour, 20 commit session)
- 4,606 lines of first-party code in ~2.0h (2,326 lines/hour, 5 commit session)
- 11,170 lines of first-party code in ~5.7h (1,967 lines/hour, 18 commit session)
- 4,471 lines of first-party code in ~2.3h (1,912 lines/hour, 16 commit session)
- 4,507 lines of first-party code in ~2.5h (1,771 lines/hour, 1 commit session)
- 6,729 lines of first-party code in ~4.3h (1,581 lines/hour, 3 commit session)
- 5,330 lines of first-party code in ~4.1h (1,287 lines/hour, 15 commit session)
- 9,198 lines of first-party code in ~7.2h (1,272 lines/hour, 21 commit session)
- 6,097 lines of first-party code in ~4.9h (1,251 lines/hour, 11 commit session)
- 1,261 lines of first-party code in ~1.1h (1,158 lines/hour, 1 commit session)
- 2,336 lines of first-party code in ~2.3h (1,007 lines/hour, 3 commit session)
- 2,333 lines of first-party code in ~2.4h (986 lines/hour, 7 commit session)
- 4,171 lines of first-party code in ~4.5h (922 lines/hour, 5 commit session)
- 1,047 lines of first-party code in ~1.2h (838 lines/hour, 3 commit session)
- excluded_import_loc
- 53,533
- flagged_loc
- 140,036
- flagged_loc_share
- 78.6%
- flagged_units
- 27
- max_loc_per_hour
- 6,930.90
- measured_loc
- 178,098
- median_loc_per_hour
- 344
- pr_timed_units
- 6
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 104
Release velocityok9 items
- v0.5.0 → v0.6.0: 45,149 lines in 4.0 days (11,290.6 lines/day)
- v0.7.0 → v0.8.0: 11,203 lines in 0.79 days (14,240.1 lines/day)
- v0.13.0 → v0.14.0: 17,146 lines in 2.87 days (5,966.3 lines/day)
- v0.15.0 → v0.16.0: 11,895 lines in 2.12 days (5,619.5 lines/day)
- v0.16.1 → v0.17.0: 7,573 lines in 0.56 days (13,641.3 lines/day)
- v0.17.0 → v0.20.0: 11,512 lines in 0.13 days (90,290.2 lines/day)
- v0.21.0 → v0.22.0: 12,851 lines in 0.45 days (28,800.0 lines/day)
- v0.25.4 → v0.26.0: 5,331 lines in 0.56 days (9,452.4 lines/day)
- v0.26.4 → v0.26.5: 5,604 lines in 0.28 days (20,203.9 lines/day)
- flagged_releases
- 9
- max_loc_per_day
- 90,290.20
- releases
- 62
Coding styleok
- count:assistant_voice
- 0
- count:emoji_in_code
- 123
- count:narrated_steps
- 0
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 32
- files:narrated_steps
- 0
- files:placeholder
- 0
- index
- 0.77
- lines_scanned
- 79,561
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 1.55
- per_kloc:narrated_steps
- 0
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 85,124
- blame_failures
- 0
- files_blamed
- 395
- other_lines
- 12,389
- quality:ai_findings
- 192
- quality:ai_per_kloc
- 2.26
- quality:other_findings
- 8
- quality:other_per_kloc
- 0.65
- quality:ratio
- 3.49
- security:ai_findings
- 230
- security:ai_per_kloc
- 2.70
- security:other_findings
- 70
- security:other_per_kloc
- 5.65
- security:ratio
- 0.48
Code quality
66 adequate
Code quality is adequate: test-to-source ratio 0.16, CI runs tests; 26% of function code in complex or long functions; 22% duplicated lines. Weakest area: duplication.
How the score is built
- Complexity46
- Duplication27
- Lint and smells70
- Tests and CI83
- Documentation100
- Type safety89
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- furnitureMarkers in frontend/src/components/view3d.ts: complexity 192, 196 lines
- furnitureMarkers in custom_components/nextfloor/frontend/nextfloor.js: complexity 178, 1 lines
- gE in custom_components/nextfloor/frontend/nextfloor-3d.js: complexity 177, 15 lines
- K0 in site/builder/builder.js: complexity 177, 15 lines
- fromJSON in custom_components/nextfloor/frontend/nextfloor-3d.js: complexity 164, 1 lines
- fromJSON in site/builder/builder.js: complexity 164, 1 lines
- w1 in custom_components/nextfloor/frontend/nextfloor-3d.js: complexity 129, 1 lines
- bd in site/builder/builder.js: complexity 129, 1 lines
- t in custom_components/nextfloor/frontend/nextfloor-3d.js: complexity 127, 1 lines
- t in site/builder/builder.js: complexity 127, 1 lines
- complex_functions
- 464
- function_nloc
- 63,211
- functions
- 17,615
- long_functions
- 29
- many_param_functions
- 117
- mean_ccn
- 3.32
- p90_ccn
- 7
- risky_nloc_share
- 25.9%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: custom_components/nextfloor/frontend/nextfloor-3d.js:9 and site/builder/builder.js:11
- 6+ duplicated lines: custom_components/nextfloor/frontend/nextfloor-3d.js:980 and custom_components/nextfloor/frontend/nextfloor-3d.js:996
- 6+ duplicated lines: custom_components/nextfloor/frontend/nextfloor-3d.js:4240 and frontend/src/viewer/fold.ts:56
- 6+ duplicated lines: custom_components/nextfloor/frontend/nextfloor-3d.js:4261 and frontend/src/viewer/theme.ts:131
- 6+ duplicated lines: custom_components/nextfloor/frontend/nextfloor-card-editor.js:26 and frontend/src/card-editor/styles.ts:5
- 6+ duplicated lines: custom_components/nextfloor/frontend/nextfloor-card-editor.js:279 and custom_components/nextfloor/frontend/nextfloor-editor.js:4520
- 6+ duplicated lines: custom_components/nextfloor/frontend/nextfloor-card-editor.js:284 and custom_components/nextfloor/frontend/nextfloor.js:4270
- 6+ duplicated lines: custom_components/nextfloor/frontend/nextfloor-editor.js:5 and custom_components/nextfloor/frontend/nextfloor.js:11
- 6+ duplicated lines: custom_components/nextfloor/frontend/nextfloor-editor.js:233 and frontend/src/components/entity-picker.ts:151
- 6+ duplicated lines: custom_components/nextfloor/frontend/nextfloor-editor.js:968 and frontend/src/components/editor/wall-view.ts:186
- compared_lines
- 77,977
- duplicated_lines
- 16,865
- duplicated_share
- 21.6%
- files
- 395
Lintok
- category:best-practice
- 29
- category:correctness
- 364
- category:maintainability
- 8
- findings
- 401
- scanned_lines
- 97,513
- weighted_findings
- 140
Tests and CIok7 items
- CI config: .github/workflows/ci.yml
.github/workflows/ci.yml - CI config: .github/workflows/issue-labels.yml
.github/workflows/issue-labels.yml - CI config: .github/workflows/pages.yml
.github/workflows/pages.yml - CI config: .github/workflows/rebuild-bundles.yml
.github/workflows/rebuild-bundles.yml - CI config: .github/workflows/release.yml
.github/workflows/release.yml - CI runs tests (pytest, npm test)
- CI runs linters (ruff, mypy)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- yes
- ci_files
- 5
- cochange_commits
- 256
- cochange_share
- 63.3%
- source_lines
- 97,513
- test_lines
- 15,903
- test_ratio
- 0.16
Documentationok4 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md - CHANGELOG.md
CHANGELOG.md
- check:changelog
- yes
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 168
Type safetyok1 item
- TypeScript strict type checking: frontend/tsconfig.json
frontend/tsconfig.json
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 290
- escapes_per_kloc
- 3.90
Security
68 weak
Security posture is weak: 18 high-severity SAST findings; 19 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets100
- Static analysis (SAST)39
- Vulnerable dependencies100
- CI workflows2
- Security posture80
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 12
- declared
- 12
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 0
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 1,011
- findings_high
- 18
- findings_low
- 5
- findings_medium
- 988
- parse_errors
- 20
- scanned_lines
- 97,513
- weighted_findings
- 260.81
Dependencies (osv-scanner)ok
- penalty
- 0
- vulnerabilities
- 0
- vulnerable_packages
- 0
- vulns_critical
- 0
- vulns_high
- 0
- vulns_low
- 0
- vulns_medium
- 0
- vulns_unknown
- 0
CI workflows (zizmor)ok
- findings
- 29
- findings_high
- 19
- findings_low
- 8
- findings_medium
- 2
- penalty
- 238.40
- workflows
- 5
Security postureok2 items
- Security policy: SECURITY.md
SECURITY.md - Dependency updates: .github/dependabot.yml
.github/dependabot.yml
- check:dependency_updates
- yes
- check:lockfiles
- yes
- check:security_policy
- yes
- check:signed_commits
- no
- signed_commit_share
- 7.0%
- unpinned_manifests
- 0
Release downloadsok5 items
- release v0.31.4.2 ships nextfloor.zip (573 downloads)
- release v0.31.4.1 ships nextfloor.zip (1657 downloads)
- release v0.31.4 ships nextfloor.zip (932 downloads)
- release v0.31.3.1 ships nextfloor.zip (1 downloads)
- release v0.31.3 ships nextfloor.zip (1617 downloads)
- binary_assets
- 10
- signals
- 1
- suspicious
- 0
Findings
40 high326 medium163 low
529 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | opengrep/typescript.lang.correctness.useless-ternary |
site/builder/builder.js:4228 | It looks like no matter how te===null is evaluated, this expression returns ge. This is probably a copy-paste error. | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
tools/area_extend.py:176 | function `steps` is defined inside a function but never used | Lint |
| high | opengrep/typescript.lang.correctness.useless-ternary |
tools/docs/build.mjs:237 | It looks like no matter how page.meta.description is evaluated, this expression returns "". This is probably a copy-paste error. | Lint |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:22 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:23 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:37 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:38 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:54 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:55 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:67 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:68 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:75 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/issue-labels.yml:15 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/pages.yml:38 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/pages.yml:42 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/pages.yml:46 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/pages.yml:81 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/pages.yml:82 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/pages.yml:86 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/rebuild-bundles.yml:19 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/rebuild-bundles.yml:20 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:17 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | opengrep/javascript.browser.security.insecure-document-method |
custom_components/nextfloor/frontend/nextfloor-card-editor.js:4 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
custom_components/nextfloor/frontend/nextfloor-card-editor.js:4 | User controlled data in a `n.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
custom_components/nextfloor/frontend/nextfloor.js:4 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
custom_components/nextfloor/frontend/nextfloor.js:4 | User controlled data in a `n.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
frontend/src/viewer/viewer3d.ts:995 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
frontend/src/viewer/viewer3d.ts:995 | User controlled data in a `el.querySelector(".nf-dev-icon")!.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
site/builder/builder.js:4 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
site/builder/builder.js:4 | User controlled data in a `n.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
tools/docs/assets/docs.js:116 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
tools/docs/assets/docs.js:116 | User controlled data in a `list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
tools/docs/assets/docs.js:37 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
tools/docs/assets/docs.js:37 | User controlled data in a `b.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
tools/docs/assets/docs.js:41 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
tools/docs/assets/docs.js:41 | User controlled data in a `b.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
tools/docs/assets/docs.js:42 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
tools/docs/assets/docs.js:42 | User controlled data in a `b.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-document-method |
tools/docs/assets/docs.js:99 | User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| high | opengrep/javascript.browser.security.insecure-innerhtml |
tools/docs/assets/docs.js:99 | User controlled data in a `list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
custom_components/nextfloor/frontend/nextfloor.js:1225 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
custom_components/nextfloor/frontend/nextfloor.js:1672 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
custom_components/nextfloor/frontend/nextfloor.js:1672 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
custom_components/nextfloor/frontend/nextfloor.js:1672 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
custom_components/nextfloor/frontend/nextfloor.js:246 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
custom_components/nextfloor/frontend/nextfloor.js:246 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
custom_components/nextfloor/frontend/nextfloor.js:851 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
custom_components/nextfloor/meshes.py:57 | Is "is_file" a function or an attribute? If it is a function, you may have meant path.is_file() because path.is_file is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
custom_components/nextfloor/meshes.py:62 | Is "is_admin" a function or an attribute? If it is a function, you may have meant request["hass_user"].is_admin() because request["hass_user"].is_admin is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
custom_components/nextfloor/meshes.py:82 | Is "is_admin" a function or an attribute? If it is a function, you may have meant request["hass_user"].is_admin() because request["hass_user"].is_admin is always true. | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
custom_components/nextfloor/schema.py:1151 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
custom_components/nextfloor/schema.py:241 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
custom_components/nextfloor/schema.py:613 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
custom_components/nextfloor/schema.py:995 | `return` only makes sense inside a function | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
frontend/light-effects-smoke.mjs:118 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
frontend/light-effects-smoke.mjs:123 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/components/editor.ts:2270 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/components/editor.ts:2934 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
frontend/src/components/editor.ts:3563 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
frontend/src/components/editor.ts:3583 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
frontend/src/components/editor.ts:3593 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
frontend/src/components/editor.ts:543 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/components/editor.ts:640 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/components/editor.ts:699 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
frontend/src/components/editor/backup.ts:37 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/components/editor/backup.ts:38 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-prompt |
frontend/src/components/editor/backup.ts:39 | found prompt() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
frontend/src/components/editor/forms/furniture-links.ts:134 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/components/model-upload.ts:168 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/components/pack-manager.ts:159 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/components/quick-menu.ts:69 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/components/room-panel.ts:414 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/components/room-panel.ts:419 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/components/view3d.ts:2402 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/components/view3d.ts:2408 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/components/view3d.ts:2413 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
frontend/src/live/cards.ts:210 | found confirm() call; should this be in production code? | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
frontend/tutorial/key.py:4 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
frontend/tutorial/tts-google.mjs:24 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
tools/prepare-model.mjs:102 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
tools/prepare-model.mjs:102 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | opengrep/javascript.lang.correctness.no-stringify-keys |
tools/prepare-model.mjs:102 | JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead. | Lint |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:10 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:3 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
custom_components/nextfloor/frontend/nextfloor-card-editor.js:4 | RegExp() called with a `i` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
custom_components/nextfloor/frontend/nextfloor.js:10 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
custom_components/nextfloor/frontend/nextfloor.js:10 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-regexp |
custom_components/nextfloor/frontend/nextfloor.js:4 | RegExp() called with a `r` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
frontend/screenshot.mjs:303 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
frontend/src/builder/app.ts:109 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:203 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:213 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:220 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:224 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:227 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:237 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:246 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:248 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:258 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:269 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:276 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:279 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:292 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:306 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:309 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:321 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:332 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:349 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:352 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:360 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:365 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:372 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment |
frontend/src/builder/app.ts:400 | Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This... | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:402 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:406 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:407 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:426 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:434 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:436 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:441 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:444 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/builder/app.ts:444 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:114 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:125 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:133 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:135 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:155 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:161 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:165 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:183 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:197 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:201 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:204 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:209 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:215 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:232 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:235 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:238 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:252 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:255 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:258 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:268 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:271 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:275 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:276 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:284 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:285 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:314 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:330 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:339 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:341 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:343 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:360 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:374 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:84 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:90 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor.ts:93 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor/form.ts:104 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor/form.ts:114 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor/form.ts:117 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor/form.ts:70 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor/form.ts:72 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor/form.ts:84 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor/form.ts:87 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor/form.ts:94 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card-editor/form.ts:97 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:250 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:250 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:251 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:252 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:283 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:285 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:285 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:286 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:289 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:298 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:299 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:304 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:305 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:319 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:404 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:432 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/card.ts:436 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:1059 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:1062 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:2887 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:2890 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:2999 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3001 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3002 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3003 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3005 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3009 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3020 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3026 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3312 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3315 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3321 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3327 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3332 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3352 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3356 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3358 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3362 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3366 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3393 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3423 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3426 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3429 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3436 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3452 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3459 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3460 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3481 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3481 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3500 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3510 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3514 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3517 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3518 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:3538 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:616 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:894 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:908 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:912 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:937 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:940 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor.ts:941 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:188 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:190 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:191 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:196 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:208 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:214 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:222 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:237 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:238 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:238 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:239 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:241 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:247 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:252 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:252 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/ble-locate.ts:253 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:120 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
frontend/src/components/editor/fields.ts:124 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:131 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:135 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:147 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:151 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:158 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:161 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:166 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:32 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:51 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:59 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:62 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:69 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:77 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:81 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/fields.ts:95 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/first-steps.ts:50 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/first-steps.ts:54 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/first-steps.ts:54 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/first-steps.ts:77 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/first-steps.ts:82 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/first-steps.ts:84 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/arc.ts:25 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/arc.ts:35 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/arc.ts:39 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/background.ts:11 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/background.ts:20 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/background.ts:40 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/background.ts:53 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/background.ts:69 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:10 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:28 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:36 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:39 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:46 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:62 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:64 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:65 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:69 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:75 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:78 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:82 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:83 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:84 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/backup.ts:90 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/compass.ts:22 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:100 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:100 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:103 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:116 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:117 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:120 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:120 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:121 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:149 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:31 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:42 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:45 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:46 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:47 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:54 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:55 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:64 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:71 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:72 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:75 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:89 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:95 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device-list.ts:96 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device.ts:100 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device.ts:104 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device.ts:121 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device.ts:123 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device.ts:50 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device.ts:54 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device.ts:80 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device.ts:95 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/device.ts:99 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/edges.ts:64 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/edges.ts:67 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/edges.ts:69 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/edges.ts:74 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/edges.ts:75 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/edges.ts:77 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/edges.ts:79 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/edges.ts:80 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/edges.ts:82 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/edges.ts:84 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/edges.ts:86 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/edges.ts:91 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/edges.ts:93 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/edges.ts:99 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:132 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:139 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:140 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:191 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:198 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:201 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:207 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:209 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:231 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:240 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:245 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:251 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:35 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:39 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:49 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:53 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:55 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:62 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:69 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/energy.ts:96 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/floor.ts:43 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/floor.ts:55 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/floor.ts:60 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/floor.ts:68 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/floor.ts:69 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/floor.ts:70 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/floor.ts:73 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/floor.ts:75 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.jquery.security.audit.prohibit-jquery-html |
frontend/src/components/editor/forms/floor.ts:75 | JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low] | Static analysis (opengrep) |
| low | opengrep/javascript.lang.correctness.useless-assignment |
custom_components/nextfloor/frontend/nextfloor-card-editor.js:118 | `n` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
custom_components/nextfloor/frontend/nextfloor-card-editor.js:4 | `t` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:10 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:10 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:10 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:10 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
custom_components/nextfloor/frontend/nextfloor.js:10 | `n` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
custom_components/nextfloor/frontend/nextfloor.js:10 | `p` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
custom_components/nextfloor/frontend/nextfloor.js:10 | `t` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
custom_components/nextfloor/frontend/nextfloor.js:10 | `s` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1225 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1225 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1545 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1545 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1545 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1545 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1545 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1545 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1545 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1545 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1545 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1681 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1681 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1681 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1681 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1681 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1691 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:1691 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:301 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
custom_components/nextfloor/frontend/nextfloor.js:3855 | `n` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:4 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:4 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
custom_components/nextfloor/frontend/nextfloor.js:4 | `t` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
custom_components/nextfloor/frontend/nextfloor.js:4 | `t` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
custom_components/nextfloor/frontend/nextfloor.js:4 | `h` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
custom_components/nextfloor/frontend/nextfloor.js:4 | `o` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:7 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:7 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:7 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:7 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:832 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
custom_components/nextfloor/frontend/nextfloor.js:832 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:147 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:147 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:169 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:169 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:170 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:170 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:254 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:254 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:41 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:41 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:54 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:54 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:62 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:62 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:66 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:66 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:69 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:77 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:79 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:79 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:86 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/screenshot.mjs:86 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/backup.ts:152 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/backup.ts:152 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/backup.ts:157 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/backup.ts:157 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/backup.ts:162 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/backup.ts:162 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/backup.ts:175 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/backup.ts:175 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/backup.ts:238 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/backup.ts:238 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/forms/edges.ts:57 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/forms/edges.ts:57 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/forms/edges.ts:57 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/forms/edges.ts:57 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/forms/edges.ts:57 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/forms/solar.ts:138 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/forms/solar.ts:138 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/forms/solar.ts:138 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/forms/solar.ts:138 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/print.ts:140 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/editor/print.ts:140 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/room-panel.ts:579 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/room-panel.ts:579 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/room-panel.ts:588 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/room-panel.ts:588 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/room-panel.ts:602 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/room-panel.ts:602 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/room-panel.ts:611 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/room-panel.ts:611 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/view3d.ts:1517 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/view3d.ts:1517 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/view3d.ts:2585 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/view3d.ts:2585 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/view3d.ts:2668 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/components/view3d.ts:2668 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/transfer.ts:127 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/transfer.ts:131 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/viewer/fold.ts:44 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/viewer/fold.ts:44 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/viewer/theme.ts:130 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/viewer/theme.ts:130 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/viewer/theme.ts:183 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/src/viewer/theme.ts:183 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/tutorial/episodes/05-devices.mjs:14 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/tutorial/episodes/05-devices.mjs:14 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/tutorial/episodes/08-lights.mjs:65 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/tutorial/episodes/08-lights.mjs:65 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/tutorial/lib.mjs:31 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/tutorial/lib.mjs:31 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/tutorial/rec.mjs:112 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/tutorial/rec.mjs:235 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/tutorial/rec.mjs:235 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/tutorial/rec.mjs:246 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/tutorial/rec.mjs:246 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/tutorial/rec.mjs:246 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/tutorial/rec.mjs:287 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
frontend/tutorial/rec.mjs:287 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
site/builder/builder.js:10 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
site/builder/builder.js:10 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
site/builder/builder.js:116 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
site/builder/builder.js:116 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
site/builder/builder.js:4 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
site/builder/builder.js:4 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
site/builder/builder.js:4 | `t` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
site/builder/builder.js:4 | `n` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
site/builder/builder.js:4 | `S` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
site/builder/builder.js:4 | `t` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
site/builder/builder.js:4 | `o` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
site/builder/builder.js:4 | `M` is assigned twice; the first assignment is useless | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
site/builder/builder.js:6 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
site/builder/builder.js:6 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
site/builder/builder.js:74 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
site/builder/builder.js:74 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | zizmor/artipacked |
.github/workflows/ci.yml:22 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:37 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:54 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:67 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/pages.yml:38 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/pages.yml:42 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/rebuild-bundles.yml:19 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/release.yml:17 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-4 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 200 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 29 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 0 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 300 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 0 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 22d84c1aa535 | prov-5+qual-2+sec-2 | 87% | 66 | 68 |
| 2026-11-14 | 22d84c1aa535 | prov-4+qual-2+sec-2 | 87% | 66 | 68 |
Full text report
- Repository: https://github.com/therealMRBK/NextFloor
- Commit:
22d84c1aa5355388b5e6cb55562d004979e422e9 - Generated: 2026-11-14T14:52:07+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 87 | explicit | 95% | 100% |
| Code quality | 66 | adequate | 90% | 100% |
| Security | 68 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 87% of first-party code added; an estimated 87% including velocity signals.
- Explicitly attributed share (lower bound): 87.1%
- Unattributed share in AI-consistent velocity bursts: 12.6%
- Estimated AI-generated share: 87.1%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 370 | 201,690 |
- AI tooling configured in repo: claude-code
Current source lines last changed by AI-attributed commits: 85,124 of 97,513.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 2.256 | 0.646 | 3.49x |
| Security | 2.702 | 5.65 | 0.48x |
- Stylometry index: 0.77 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 123). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-10 | 144,170 | 79% |
| 2026-11 | 87,461 | 100% |
Evidence
- Claude Code: trailer 'Co-authored-by: Claude' (22d84c1aa535)
- Claude Code: trailer 'Co-Authored-By: Claude' (3cf541fd1e1a)
- Claude Code: trailer 'Co-Authored-By: Claude' (a149d9dfb637)
- Claude Code: trailer 'Co-Authored-By: Claude' (b7103e2376b6)
- Claude Code: trailer 'Co-Authored-By: Claude' (a6ba24a35d56)
- Claude Code: trailer 'Co-Authored-By: Claude' (7f419e95867a)
- Claude Code: trailer 'Co-Authored-By: Claude' (033ec04347e3)
- Claude Code: trailer 'Co-Authored-By: Claude' (8bdf4b08c824)
- Claude Code: trailer 'Co-Authored-By: Claude' (51c6a05e5165)
- Claude Code: trailer 'Co-Authored-By: Claude' (2dce41b0c626)
- Claude Code: trailer 'Co-Authored-By: Claude' (ad37b48e30b4)
- Claude Code: trailer 'Co-Authored-By: Claude' (1a07b956f0f9)
- Claude Code: trailer 'Co-Authored-By: Claude' (74fdf8c60cc6)
- Claude Code: trailer 'Co-Authored-By: Claude' (ca7a3cc8bfc8)
- Claude Code: trailer 'Co-Authored-By: Claude' (b5e8fb6df25c)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.16, CI runs tests; 26% of function code in complex or long functions; 22% duplicated lines. Weakest area: duplication.
| Area | Score |
|---|---|
| Complexity (lizard) | 46 |
| Duplication | 27 |
| Code smells (Opengrep) | 70 |
| Tests and CI | 83 |
| Documentation | 100 |
| Type safety | 89 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 17,615; mean complexity 3.3, 90th percentile 7; 464 complex and 29 long functions
- Duplicated lines: 21.6% of 77,977 compared
- Tests: 15,903 test lines for 97,513 source lines (ratio 0.16); CI test commands: pytest, npm test; 63% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- furnitureMarkers in frontend/src/components/view3d.ts: complexity 192, 196 lines
- furnitureMarkers in custom_components/nextfloor/frontend/nextfloor.js: complexity 178, 1 lines
- gE in custom_components/nextfloor/frontend/nextfloor-3d.js: complexity 177, 15 lines
- K0 in site/builder/builder.js: complexity 177, 15 lines
- fromJSON in custom_components/nextfloor/frontend/nextfloor-3d.js: complexity 164, 1 lines
Security
Security posture is weak: 18 high-severity SAST findings; 19 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 39 |
| Vulnerable dependencies (OSV) | 100 |
| CI workflows (zizmor) | 2 |
| Posture (policy, updates, signing, lockfiles) | 80 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: security policy, dependency updates, lockfiles; missing: signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
custom_components/nextfloor/frontend/nextfloor-card-editor.js:4 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a n.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
custom_components/nextfloor/frontend/nextfloor-card-editor.js:4 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
custom_components/nextfloor/frontend/nextfloor.js:4 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a n.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
custom_components/nextfloor/frontend/nextfloor.js:4 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
frontend/src/viewer/viewer3d.ts:995 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a el.querySelector(".nf-dev-icon")!.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
frontend/src/viewer/viewer3d.ts:995 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
site/builder/builder.js:4 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a n.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
site/builder/builder.js:4 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
tools/docs/assets/docs.js:37 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a b.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
tools/docs/assets/docs.js:37 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
tools/docs/assets/docs.js:41 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a b.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
tools/docs/assets/docs.js:41 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
tools/docs/assets/docs.js:42 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a b.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
tools/docs/assets/docs.js:42 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
tools/docs/assets/docs.js:99 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a list.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
tools/docs/assets/docs.js:99 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
tools/docs/assets/docs.js:116 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a list.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
tools/docs/assets/docs.js:116 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:22 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:23 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:37 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:38 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:54 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:55 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:67 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v0.31.4.2 ships nextfloor.zip (573 downloads)
- binary-release-asset: release v0.31.4.1 ships nextfloor.zip (1657 downloads)
- binary-release-asset: release v0.31.4 ships nextfloor.zip (932 downloads)
- binary-release-asset: release v0.31.3.1 ships nextfloor.zip (1 downloads)
- binary-release-asset: release v0.31.3 ships nextfloor.zip (1617 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 97,513; test lines: 15,903
| Language | Lines |
|---|---|
| TypeScript | 75,148 |
| JavaScript | 23,226 |
| Python | 15,042 |