From 854f5a1558a41a92f06ad1e3e262d8f7422a0df3 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Tue, 6 Oct 2026 14:41:27 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?=
 =?UTF-8?q?x=20DOM=20XSS=20via=20unescaped=20numeric=20properties=20in=20d?=
 =?UTF-8?q?ashboard?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 scanner/dashboard/console.html | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/scanner/dashboard/console.html b/scanner/dashboard/console.html
index 7ec262af4..c35e6da0f 100644
--- a/scanner/dashboard/console.html
+++ b/scanner/dashboard/console.html
@@ -121,10 +121,10 @@ <h1>AppGuardrail Console</h1>
     const latest=scans[0]||{severity_counts:{}};
     const c=latest.severity_counts||{};
     $("#stats").innerHTML=[
-      ["Latest deploy-blocking",latest.deploy_blocking||0],
-      ["New since last scan",latest.new_blocking||0],
-      ["Critical",c.CRITICAL||0],
-      ["Scans stored",scans.length],
+      ["Latest deploy-blocking",Number(latest.deploy_blocking)||0],
+      ["New since last scan",Number(latest.new_blocking)||0],
+      ["Critical",Number(c.CRITICAL)||0],
+      ["Scans stored",Number(scans.length)||0],
     ].map(([l,n])=>`<div class="stat"><div class="l">${l}</div><div class="n">${n}</div></div>`).join("");
     const ord=[...scans].reverse();
     const max=Math.max(1,...ord.map(s=>s.deploy_blocking||0));
@@ -133,7 +133,7 @@ <h1>AppGuardrail Console</h1>
       return `<div class="bar" tabindex="0" role="img" aria-label="${esc(s.created_at)}: ${esc(String(s.deploy_blocking||0))} blocking" title="${esc(s.created_at)}: ${esc(String(s.deploy_blocking||0))} blocking" style="height:${h}px;background:${col}"></div>`;}).join("")||'<span class="muted">No scans yet.</span>';
     $("#history tbody").innerHTML=scans.map(s=>`<tr class="scan" data-id="${s.id}" tabindex="0" role="button" title="View scan details">
       <td>${esc(s.created_at)}</td><td>${esc(s.repo||"—")}</td><td><code>${esc((s.commit||"—").slice(0,10))}</code></td>
-      <td>${s.total}</td><td>${pill(s.deploy_blocking,"var(--crit)")}</td><td>${pill(s.new_blocking,"var(--high)")}</td></tr>`).join("")||'<tr><td colspan="6" class="muted">No scans. POST to /api/v1/scans from CI.</td></tr>';
+      <td>${Number(s.total)||0}</td><td>${pill(Number(s.deploy_blocking)||0,"var(--crit)")}</td><td>${pill(Number(s.new_blocking)||0,"var(--high)")}</td></tr>`).join("")||'<tr><td colspan="6" class="muted">No scans. POST to /api/v1/scans from CI.</td></tr>';
     document.querySelectorAll("tr.scan").forEach(tr=>{
       tr.onclick=()=>detail(tr.dataset.id,tr);
       tr.addEventListener('keydown', e => { if(e.key === 'Enter' || e.key === ' ') { e.preventDefault(); detail(tr.dataset.id,tr); } });
@@ -155,7 +155,7 @@ <h1>AppGuardrail Console</h1>
   try{
     const s=await api("/api/v1/scans/"+id);
     if(requestId!==currentDetailRequest)return;
-    const rows=(s.findings||[]).map(f=>`<tr><td><span class="pill" style="background:${SEV[f.severity]||'var(--info)'}">${esc(f.severity)}</span></td>
+    const rows=(s.findings||[]).map(f=>`<tr><td><span class="pill" style="background:${SEV[String(f.severity).toUpperCase()]||'var(--info)'}">${esc(f.severity)}</span></td>
       <td><code>${esc(f.rule_id)}</code></td><td>${esc((f.message||"").split("\n")[0].slice(0,120))}</td>
       <td><code>${esc(f.file)}:${esc(f.line)}</code></td></tr>`).join("");
     d.innerHTML=`<button type="button" class="close-btn" aria-label="Close details">✕</button><strong>Scan #${esc(s.id)}</strong> <span class="muted">${esc(s.created_at)} · ${esc(s.repo||"—")}</span>