[seonghobae]

🚨 Severity: HIGH

💡 Vulnerability: untrusted numerical data 및 severity 문자열 등이 scanner/dashboard/console.html에서 escaping 또는 타입 강제 변환 없이 innerHTML에 삽입되어 DOM XSS 취약점이 존재했습니다.

🎯 Impact: 공격자가 악의적인 페이로드가 포함된 스캔 결과를 주입하면, 콘솔 뷰어를 보는 관리자의 브라우저에서 스크립트가 실행되어 세션 탈취 등의 공격이 가능해집니다.

🔧 Fix:

• 수치형 데이터에 대해 Number() 래퍼를 사용하여 동적 DOM 생성 시 타입을 엄격히 제어했습니다.
• String(f.severity).toUpperCase()로 정규화하여 딕셔너리 매핑 취약점을 방지했습니다.
• esc() 래퍼를 사용해 untrusted 값을 확실하게 escaping 하였습니다.

✅ Verification: Playwright를 사용하여 DOM을 렌더링하고 악의적 입력값이 주입된 가상의 테스트 결과를 불러왔을 때 정상적으로 텍스트로 처리되고 스크립트가 실행되지 않음을 스크린샷으로 확인하였고, Python 단위 테스트( test_console_dashboard_security.py)가 통과함을 확인했습니다.

---

PR created automatically by Jules for task 3045702934668945300 started by @seonghobae

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 39 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: eac8f036-751f-4a8d-bd4a-69229a8eac8a

📥 Commits

Reviewing files that changed from the base of the PR and between 2949d30 and 7ca5acd.

📒 Files selected for processing (2)

• .jules/sentinel.md
• scanner/dashboard/console.html

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Verified complete successor carryover before retirement

Exact source head: 7ca5acd0f31b6f22e566f91629ad3e183dcd6588.

Every valid delta is preserved more strongly by the canonical stack:

• fix(dashboard): reject inherited map properties #1260 exact 98ed23c85b061f2e8068f9523ac160a86ec0c94d owns severity normalization, inherited-key rejection, INFO fallback, filtering and ordering with executable regressions;
• fix(console): bound scalar rendering and scan identifiers #1314 exact a7c934a3f9ca5896b73ad408385e061b4d4e1a5f owns count and scan-ID rendering, using bounded non-negative safe integers and HTML encoding.

#1418's Number(...) || 0 admits negative, fractional and infinite values and has no committed executable regression; it is therefore weaker than #1314. Its DOM-XSS claim is not independently reproduced beyond the scalar/attribute boundary already carried.

This PR is being retired unmerged only after verified complete carryover. No branch deletion, force push, gate bypass, approval transfer, or release claim is made.