chore: retire carried static-dashboard duplicate by seonghobae · Pull Request #1399 · ContextualWisdomLab/appguardrail

seonghobae · 2026-10-05T19:02:47Z

Retired after verified complete carryover

Original finding head: 861f36354fa32b77b1f7f9e59532f2ead7bbf331
Ordinary source-neutral retirement head: 0266446214dabccd2f0193421fa9b7e5cd8fc066
Protected base/tree: develop@2949d30718752ea5915c7713ba227e8c19d9e5bf / ec4525421f9ed758966e1929a45af4a44b0b81e1
Exact comparison: 2 ahead / 0 behind / changed files []
Canonical successor: fix(dashboard): reject inherited map properties #1260 exact 146cc63da545ee9e8b410edc91a9958205760e13

#1260 carries every reproducible product requirement: own-key severity authorization with INFO fallback, null-prototype category aggregation, preserved visible-text escaping, and direct Node-backed prototype-name regressions. Focused contracts pass 5/5 and the full local suite passes 1,094/1,094. This also satisfies #1399's sole unresolved review finding about missing hostile-category/severity execution coverage.

The original prototype-pollution/DOM-XSS claims were not reproduced; the tests demonstrate prototype-chain lookup/collision while Object.prototype remains unchanged. Re-escaping fixed allowlist color constants and the unsupported .jules lesson are not separate valid deltas.

This predecessor is closed only after ordinary protected-tree restoration and exact zero-diff proof. No force push, destructive rebase, valid-delta loss, gate weakening, merge, or release occurred. #1260 remains open and merge-HOLD pending executable exact-head Checks and qualifying review.

AppGuardrail 대시보드(scanner/dashboard/index.html)에서 발생하는 프로토타입 오염(Prototype Pollution) 및 DOM 기반 크로스 사이트 스크립팅(DOM XSS) 취약점을 수정했습니다. - 사용자 입력 기반 카테고리를 담는 `byCat` 객체를 `Object.create(null)`로 초기화하여 프로토타입 오염 방지 - 객체 키 유효성 검증 시 프로토타입 체인을 무시하도록 `in` 연산자 대신 `Object.hasOwn` 사용 - 객체 속성(e.g., `SEV[sevKey].color`)이 DOM 템플릿에 안전하게 바인딩되도록 `esc()` 함수 래핑 적용

google-labs-jules · 2026-10-05T19:02:49Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

coderabbitai · 2026-10-05T19:02:57Z

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

devin-ai-integration

Devin Review found 1 potential issue.

devin-ai-integration · 2026-10-05T19:03:45Z

+  const byCat = Object.create(null);
  let blocking = 0;
  for(const f of ALL){
    const s = String(f.severity||'INFO').toUpperCase();
-    counts[s in counts ? s : 'INFO']++;
+    counts[Object.hasOwn(counts, s) ? s : 'INFO']++;
    const c = String(f.category||'misconfig');
    byCat[c] = (byCat[c]||0)+1;


🔍 Hostile findings lack rendering tests

Existing dashboard tests inspect source text, not rendered output. A test loading __proto__ categories and CONSTRUCTOR severities would cover the changed lookup and aggregation paths.

Was this helpful? React with 👍 or 👎 to provide feedback.

seonghobae · 2026-10-07T04:10:28Z

Canonical-writer carryover rationale

Fresh exact-head review of 861f36354fa32b77b1f7f9e59532f2ead7bbf331 confirms only .jules/sentinel.md and scanner/dashboard/index.html change.

Canonical #1260 exact 146cc63da545ee9e8b410edc91a9958205760e13 completely carries the reproducible product behavior:

own-property severity authorization with INFO fallback;
null-prototype arbitrary-category aggregation;
preserved visible-text escaping;
direct Node-backed inherited-key/category regressions;
focused 5/5 and full 1,094/1,094 local GREEN.

This also satisfies the sole unresolved #1399 review finding that hostile __proto__ categories and constructor severities lacked executable rendering-boundary coverage. Re-escaping a color selected from the fixed own-key SEV allowlist is not a distinct security requirement. The .jules prototype-pollution/DOM-XSS claim was not reproduced; tests show Object.prototype remains unchanged.

The PR is Draft and will be retired only through an ordinary source-neutral child restoring protected develop@2949d30718752ea5915c7713ba227e8c19d9e5bf, followed by exact zero-diff comparison. #1260 stays open and merge-HOLD; no force push, destructive rebase, gate weakening, or valid-delta loss is authorized.

Canonical PR #1260 preserves every reproducible product delta and resolves the missing hostile-input regression finding. Restore the protected tree while retaining #1399 history.

google-labs-jules · 2026-10-07T04:12:06Z

Canonical-writer carryover rationale

Fresh exact-head review of 861f36354fa32b77b1f7f9e59532f2ead7bbf331 confirms only .jules/sentinel.md and scanner/dashboard/index.html change.

Canonical #1260 exact 146cc63da545ee9e8b410edc91a9958205760e13 completely carries the reproducible product behavior:

own-property severity authorization with INFO fallback;

null-prototype arbitrary-category aggregation;

preserved visible-text escaping;

direct Node-backed inherited-key/category regressions;

focused 5/5 and full 1,094/1,094 local GREEN.

This also satisfies the sole unresolved #1399 review finding that hostile __proto__ categories and constructor severities lacked executable rendering-boundary coverage. Re-escaping a color selected from the fixed own-key SEV allowlist is not a distinct security requirement. The .jules prototype-pollution/DOM-XSS claim was not reproduced; tests show Object.prototype remains unchanged.

The PR is Draft and will be retired only through an ordinary source-neutral child restoring protected develop@2949d30718752ea5915c7713ba227e8c19d9e5bf, followed by exact zero-diff comparison. #1260 stays open and merge-HOLD; no force push, destructive rebase, gate weakening, or valid-delta loss is authorized.

Understood. Acknowledging that this work is now obsolete and stopping work on this task.

github-project-automation Bot added this to Security Oct 5, 2026

devin-ai-integration Bot reviewed Oct 5, 2026

View reviewed changes

seonghobae marked this pull request as draft October 7, 2026 04:10

chore: retire carried static-dashboard duplicate

0266446

Canonical PR #1260 preserves every reproducible product delta and resolves the missing hostile-input regression finding. Restore the protected tree while retaining #1399 history.

seonghobae changed the title ~~🛡️ Sentinel: [HIGH] 프로토타입 오염 및 DOM XSS 수정~~ chore: retire carried static-dashboard duplicate Oct 7, 2026

seonghobae closed this Oct 7, 2026

seonghobae mentioned this pull request Oct 7, 2026

docs: record product and technical gap baseline #999

Draft

Navigation Menu

Repository navigation

chore: retire carried static-dashboard duplicate - #1399

chore: retire carried static-dashboard duplicate#1399
seonghobae wants to merge 2 commits into
developfrom
sentinel-fix-xss-pollution-9862457172789099072

seonghobae commented Oct 5, 2026 •

edited

Loading

Uh oh!

google-labs-jules Bot commented Oct 5, 2026

Uh oh!

coderabbitai Bot commented Oct 5, 2026 •

edited

Loading

Draft PR not reviewed

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

devin-ai-integration Bot Oct 5, 2026

Uh oh!

seonghobae commented Oct 7, 2026

Uh oh!

google-labs-jules Bot commented Oct 7, 2026

Canonical-writer carryover rationale

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

seonghobae commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Retired after verified complete carryover

Uh oh!

google-labs-jules Bot commented Oct 5, 2026

Uh oh!

coderabbitai Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Draft PR not reviewed

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

seonghobae commented Oct 7, 2026

Canonical-writer carryover rationale

Uh oh!

google-labs-jules Bot commented Oct 7, 2026

Canonical-writer carryover rationale

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Oct 5, 2026 •

edited

Loading

coderabbitai Bot commented Oct 5, 2026 •

edited

Loading