chore(UVE): Migrate UVE Experiments#34345
chore(UVE): Migrate UVE Experiments#34345hmoreras merged 14 commits intoissue-33882-primeng-updatefrom
Conversation
Legal RiskThe following dependencies were released under a license that RecommendationWhile merging is not directly blocked, it's best to pause and consider what it means to use this license before continuing. If you are unsure, reach out to your security team or Semgrep admin to address this issue. GPL-2.0 MPL-2.0
|
rjvelazco
changed the title
|
Semgrep found 25
Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the Fix: Upgrade this library to at least version 21.0.7 at core/core-web/package-lock.json:5082. Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
![semgrep-code-dotcms-test[bot]](https://avatars.githubusercontent.com/u/1005263?s=60&v=4){kind=small}
| @Component({ | ||
| selector: 'dot-experiments-experiment-summary', | ||
| imports: [CommonModule, DotMessagePipe, ButtonModule], | ||
| imports: [CommonModule, DotMessagePipe], | ||
| templateUrl: './dot-experiments-experiment-summary.component.html', | ||
| styleUrls: ['./dot-experiments-experiment-summary.component.scss'], | ||
| changeDetection: ChangeDetectionStrategy.OnPush | ||
| changeDetection: ChangeDetectionStrategy.OnPush, | ||
| host: { | ||
| class: 'flex justify-center p-4 text-gray-800 leading-[140%]' | ||
| } | ||
| }) |
There was a problem hiding this comment.
High severity and reachable issue identified in your code:
Line 7 has a vulnerable usage of @angular/compiler, introducing a high severity vulnerability.
ℹ️ Why this is reachable
A reachable issue is a real security risk because your project actually executes the vulnerable code. This issue is reachable because your code uses a certain version of @angular/compiler.
Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the href and xlink:href attributes on SVG <script> elements as Resource URL contexts. This allows an attacker to bind a malicious data: URI or external script via [attr.href] or [attr.xlink:href], resulting in arbitrary JavaScript execution (XSS) in the victim's browser.
To resolve this comment:
Upgrade this dependency to at least version 21.0.7 at core-web/package-lock.json.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
If this is a critical or high severity finding, please also link this issue in the #security channel in Slack.
You can view more details on this finding in the Semgrep AppSec Platform here.
core-web/apps/dotcms-ui/src/app/view/components/_common/dot-alert-confirm/dot-alert-confirm.ts
Show resolved
Hide resolved
|
Semgrep found 2
Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the Fix: Upgrade this library to at least version 21.0.7 at core/core-web/package-lock.json:5082. Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
|
Semgrep found 3
Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the Fix: Upgrade this library to at least version 21.0.7 at core/core-web/package-lock.json:5082. Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
…ve unused SCSS file
|
Semgrep found 1
Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the Fix: Upgrade this library to at least version 21.0.7 at core/core-web/package-lock.json:5082. Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
…d syntax, update template bindings for reactive data
…nhance template expressions for improved reactivity
…r improved functionality and usability
2 participants
Walkthrough
walkthrough.mov
Videos
video.mov
video.mov
Screenshots
This PR fixes: #34248
This PR fixes: #34248