Extend the XSS PR guardrail to the V2 React/TypeScript UI

[Paul Lizer (paullizer)]

Summary

The XSS PR guardrail (scripts/check_xss_sinks.py and xss-sink-check.yml) only read .js, .html and .py files, and none of the PR guardrail workflows ran on PRs into paullizer-react-v2-ui. So the V2 React/TypeScript UI (463 files, about 143k lines in application/v2_ui/src) had no XSS sink check at all, and V2 PRs got only enforce-branch-flow and the CLA check.

This PR:

• teaches the checker .ts, .tsx, .jsx and .mjs with 11 React-aware rules. A small TypeScript/JSX lexer blanks comments, strings, template chunks, regex bodies and JSX text, so rules match real code and not type annotations or comments.
• runs the six PR guardrail workflows on PRs into paullizer-react-v2-ui. Each entry is marked temporary until V2 merges into Development.
• adds xss-full-scan.yml, an on-demand whole-file scan that mirrors broken-access-control-full-scan.yml.
• updates the XSS instruction (applyTo plus a React/TypeScript section), the audit prompt, the feature doc and two related docs.
• records a reviewed baseline: the tuned rules report 28 findings in the current V2 source, and all 28 are safe.

This is tooling only: no application/ change, no VERSION bump and no release-notes entry. That matches the SHA-pinning and CodeQL-PR-pipeline precedents.

Rules added

All rules apply to .ts, .tsx, .jsx and .mjs. Declaration files (.d.ts, .d.mts, .d.cts) and application/v2_ui/public/vendor/ are skipped. Suppress a finding with xss-check: ignore <reason> on the same line. In these files a bare token without a reason does not suppress.

Rule id	Flags	Accepts
ts-dangerous-inner-html	dangerouslySetInnerHTML whose __html isn't a sanitized value	DOMPurify.sanitize(...), sanitize* or escape*Html helpers, literals, and a useMemo that returns one of these
ts-html-sink	innerHTML/outerHTML assignment, insertAdjacentHTML, document.write, createContextualFragment, and DOMParser output inserted into the DOM	the same sanitized values
ts-code-eval	eval, new Function, and a string first argument to setTimeout/setInterval	function arguments
ts-javascript-url	a javascript: scheme inside a string or template literal	a literal that is only the bare scheme, as used in blocklists
ts-jsx-url-attribute	dynamic href, xlinkHref or formAction; srcDoc; src on script/iframe/frame/embed; action on <form>; data on <object>; to on react-router Link/NavLink/Navigate	literals and same-origin paths; safe template prefixes followed by encodeURIComponent segments; sanitize*/normalize*/safe* URL helpers; reviewed builders; isSafeOriginHref or ^https?:// guards; upper-case constants
ts-navigation-sink	window.open, location.href =, location =, and location.assign/replace with a dynamic value	the same URL sources, plus statement guards such as if (!ok) return;
ts-markdown-raw-html	rehype-raw, allowDangerousHtml, or an identity urlTransform	defaultUrlTransform and sanitize*/safe*/normalize* transforms
ts-dom-url-property	DOM .href, .src, .action, .formAction and .srcdoc assignments, and setAttribute(...) for those attributes, with a dynamic value	the same URL sources; image and media receivers for src; .action only on form receivers
ts-inline-event-handler	inline on*= handlers in HTML strings, and inline-handler APIs	(port of the classic check)
ts-attribute-interpolation	${...} interpolated into href/src/title/style/data-* attributes of HTML strings	the classic allowances (port of the classic check)
ts-marked-parse	marked.parse(...) without DOMPurify.sanitize( nearby	(port of the classic check)

The existing .js, .html and .py checks are unchanged, and the four original self-tests pass unmodified. I compared the old and new checker on all 2,881 tracked classic files. The old one reports 498 findings and the new one 472. The only difference is 26 findings in the vendored DOMPurify (1) and Mermaid (25) bundles under application/v2_ui/public/vendor/, which are now skipped.

Baseline triage (counts)

Full mode (no SHAs) over the 462 inspected V2 files:

Rule id	Raw	First pass	Tuned
ts-dangerous-inner-html	4	4	4
ts-html-sink	1	1	1
ts-code-eval	0	0	0
ts-javascript-url	3	3	3
ts-jsx-url-attribute	32	15	14
ts-navigation-sink	8	4	4
ts-markdown-raw-html	0	0	0
ts-dom-url-property	11	8	2
ts-inline-event-handler	0	0	0
ts-attribute-interpolation	0	0	0
ts-marked-parse	0	0	0
Total	59	35	28

• Raw turns off every approval, guard and suppression, so it measures the size of the surface. First pass is the rule set as first designed. Tuned is what the checker reports now.
• All 28 tuned findings are safe (28 safe, 0 unsafe), and none is an exploitable XSS.
  • 4 dangerouslySetInnerHTML sites sanitize KaTeX (trust: false) or Mermaid (securityLevel: 'strict') output with DOMPurify. test_v2_rich_rendering.py already guards that boundary.
  • 3 are deliberate test samples in the dev-only Alert Lab.
  • 21 are URLs traced to server-built paths, ^https?:// or isSafeOriginHref guards, encoded ids, or fixed constants.
• Every row, with its one-line reason, is in docs/explanation/features/v0.241.022/XSS_PR_GUARDRAILS_V2_BASELINE_TRIAGE.md, along with the tuning table and the lexer audit.
• Reconciliation with the coordinator's scan:
  • The lexer finds 56 dynamic href/src/action/formAction JSX attributes in 42 files (the quick scan found 53 in 40). Of those, 22 are <img src> (not a script sink), 16 are action props on custom components (none is on a <form>), 16 are <a href>, 1 is an <iframe src> and 1 is an image-canvas src.
  • The file count is 463 in src, not 464. vite.config.ts sits outside src, and two declaration files are skipped.
• Lexer audit: 464 files, about 2 s, 19,763 JSX attributes. No file needed the degraded fallback, no JSX retries, and brackets balance in every file.

Workflows

Workflow	Change	Blocking on V2 PRs
xss-sink-check.yml	V2 added to pull_request.branches; application/**/*.ts, *.tsx, *.jsx and *.mjs added to the paths filter and the xss_surface list; xss-full-scan.yml added to the guardrail paths	Scan step: yes. Self-test step: advisory (unchanged)
broken-access-control-check.yml	V2 added to pull_request.branches	yes
swagger-route-check.yml	V2 added to pull_request.branches	yes
python-syntax-check.yml	V2 added to pull_request.branches	yes
malicious-pr-security-review.yml	V2 added to pull_request.branches	blockers only (unchanged)
codeql.yml	V2 added to push and pull_request (block style, so the comment fits)	per repository code-scanning settings
xss-full-scan.yml (new)	workflow_dispatch only: target_paths (default application), fail_on_findings (default false), run_self_tests (default true), and the xss-full-scan-report artifact. All actions are pinned to full SHAs	n/a

• Every V2 entry carries # Temporary: remove when paullizer-react-v2-ui merges into Development (#1571). The self-test fails if a workflow names the V2 branch without that comment.
• Fork PRs: recent PRs from paullizer/simplechat into Development (Fix group document filename XSS in Share controls and cards #1500, Revert accidental OneNote rollout from Development #1538, Add admin defaults for new chat model and reasoning effort #1520) ran all six workflows, including CodeQL's SARIF upload, and passed. So none had to be left out.
• Precedent: d89707852 ("Run the quality gates on PRs into the IA staging branch") did the same for feature/admin-settings-ia on the same six workflows, and a5ed90f55 reverted it before the final merge.
• CodeQL on push: that precedent left CodeQL's push alone. The coordinator's review asked for both push and pull_request here, which also gives V2 PRs a base-branch analysis to compare against.
• Not changed:
  • release-notes-check.yml stays Development-only, as instructed. It also fails on fork PRs for token reasons.
  • The staging, publish and enforce-branch-flow workflows are unchanged.
  • Existing tag-ref uses: lines are left for Pin GitHub Actions to full-length commit SHAs #1474.
• GitHub offers a workflow_dispatch workflow only once the file is on the default branch (main). Until then, the feature doc and audit prompt give the local batched command.

What changes for V2 PRs

• PRs into paullizer-react-v2-ui now get the same guardrail checks as PRs into Development, subject to each workflow's paths filter.
• The XSS check reports added lines only. The 28 baseline findings fail a PR only if it changes a flagged line.
• When a PR does change a flagged line, the triage doc gives the reason for that line. Route the value through an accepted source, or add xss-check: ignore <reason> on the same line.
• Predicted impact on in-flight V2 work. I ran this checker in diff mode over each branch's own changes (merge-base to head, same file globs as the workflow):
  • Phase 4 (Let chat orchestration propose workflows with an Approve, Deny and Edit card #1547): 2 findings, both ts-jsx-url-attribute. They're <Link to={workflowProposalLink(...)}> in WorkflowProposalCard.tsx. Traced safe: workflowProposalLink returns the literal path /workspace/workflows? with the id encoded by URLSearchParams. It's flagged only because the helper is new on that branch and isn't a reviewed builder yet. If this PR lands first, that branch should add workflowProposalLink to TS_SAME_ORIGIN_URL_BUILDERS in its own diff, so the helper and its approval get reviewed together. If Phase 4 lands first, I'll add it here when I merge V2 in.
  • 3b (Add an AI workflow assistant to the V2 workflow editor #1548): 0 findings. Its 12 changed application files are Python.
  • Fail pytest tests that return False (#1572) #1574 (the pytest reports functional tests that return False as passed #1572 pytest guard): changes no application files, so the XSS check doesn't run.
  • Keep workflow Flow canvas nodes stable across renders (#1573) #1578 (the V2 Flow canvas rebuilds every node on unrelated re-renders, so edges drop and a Playwright test flakes #1573 Flow canvas fix, 2f8dab475..b9316eebf): 0 findings in its 3 application files, 2 of them TS-family. The coordinator's review found the same.
  • Remove redundant orchestration progress card from V2 chat #1575, merged into V2 after this branch's base: 0 findings, and it touched no baseline file, so the V2 tip's baseline is still 28.

Validation

All local runs were on Windows, one process at a time.

• venv is the pinned test venv (Python 3.12.10) with PYTHONPATH=application/single_app;functional_tests and PYTHONIOENCODING=utf-8.
• global is the system Python 3.12.10 with no PYTHONPATH, which is how the workflow invokes the self-test.

Command	Runner	Result
python functional_tests/test_xss_guardrails_checker.py	venv	12/12
python -O functional_tests/test_xss_guardrails_checker.py	venv	12/12
python functional_tests/test_xss_guardrails_checker.py	global	12/12
Mutation probe (session artifact): break the checker in memory and rerun the new tests	venv, normal and -O	8/8 mutations caught in both modes (the new checks raise explicitly)
test_chat_sidebar_conversations_escape_html.py	venv	3/3
route_tests/test_route_policy_test_coverage.py, test_route_blueprint_policy_inventory.py, test_route_unauthenticated_policy_contract.py	venv	2/2, 8/8, 4/4
test_broken_access_control_guardrails_checker.py	venv	3/4, the same as a git archive export of c33ad4d16. Pre-existing: it asserts actions/upload-artifact@v4, but the base pins v7.0.1
test_swagger_route_pr_workflow.py	venv	4/5, the same as the base. Pre-existing: it asserts tj-actions/changed-files@v46.0.1, but the base pins v47.0.6
test_malicious_pr_security_review_checker.py	venv	3/4, the same as the base. Pre-existing: it asserts actions/upload-artifact@v4, but the base uses @v7
test_docs_app_surface_coverage.py, test_docs_site_quality.py	venv	7/7, 6/6
test_docs_link_integrity.py	venv	2/5, the known base result; none of the failures involve these docs
YAML parse of the 7 edited or new workflows	venv (PyYAML)	all parse; no BOM; LF in the index; the new workflow is fully SHA-pinned
git diff --cached --check	git	clean
Full mode over V2 (462 files)	venv	28 findings, all triaged safe
Full mode over all of application/ (1,288 files, 7 batches of 200)	venv	383 findings: the 28 V2 findings plus 355 pre-existing classic findings; about 20 s
Diff mode on a synthetic commit (in the self-test, against a real temporary Git repo)	venv and global	only the added multi-line href is reported; full mode reports both lines; a comment-only change reports nothing
Diff mode over real V2 history e31772eb0..c33ad4d16 (72 commits, 85 changed files, 57 of them TS-family)	venv	3 findings, all the dev-only Alert Lab samples added in 8e9586844; about 12 s
scripts/check_malicious_pr_security_review.py --base-sha c33ad4d16 --head-sha HEAD --verify-release-age	venv	0 blockers. The 310 Important and 78 Moderate findings are keyword heuristics, expected in an XSS checker that names eval, Function and sanitizers. The 7 Low are pre-existing tag refs in codeql.yml and malicious-pr-security-review.yml (#1474)
Coordinator's run_v2_guardrails.py <worktree> c33ad4d16 HEAD 1571	venv	6/6 PASS

Checks on this PR

The six workflows ran on this fork PR into paullizer-react-v2-ui, so the new triggers work end to end for cross-repo PRs.

First run, head f77c3eedd (merge commit 0e30f8690, base 2f8dab475, the V2 tip):

Check	Result
xss-sink-check	pass (21 s). No application files changed, so the scan step exited 0. The advisory self-test ran on Linux with Python 3.12.14: 12/12
broken-access-control-check	pass (18 s). No application files changed. The advisory self-test is 3/4, the pre-existing upload-artifact@v4 assertion
swagger-route-check	pass (1 m 1 s). No application Python files changed. Route-policy tests 8/8, 4/4 and 2/2
syntax-check	pass (30 s). All Python files compiled
malicious-pr-security-review	pass (18 s). "No blocker findings detected in reviewed scope."
CodeQL Analyze (actions / javascript-typescript / python)	pass (47 s / 3 m 1 s / 11 m 49 s)
CodeQL	pass, with 1 new note (see CodeQL triage)
enforce-branch-flow, license/cla	pass

Second run, head f5e5cc758 (the CodeQL fix; merge commit 2097aeb71, same base): every check passed again. The XSS self-test is 12/12, and CodeQL reports no new alerts in code changed by this pull request, with 0 annotations. Analyze took 54 s / 3 m 6 s / 9 m 47 s.

CodeQL triage

• 1 new alert, note severity: py/empty-except on the except OSError: pass in the self-test's remove_tree helper (functional_tests/test_xss_guardrails_checker.py), which I added in this PR. The permission reset is best effort, because shutil.rmtree(..., ignore_errors=True) runs right after it. f5e5cc758 adds a comment saying so, and the self-test still passes 12/12 normally and under -O. On the second run, the CodeQL check shows no new alerts.
• No alerts on scripts/check_xss_sinks.py or the edited workflows. The workflow runs the security-and-quality suite, which includes the ReDoS queries.
• The only other annotations are GitHub's generic notice that the ubuntu-latest label moves to Ubuntu 26. They aren't code-scanning alerts.
• The code-scanning alerts API returns 403 for my token, so I read the CodeQL check run and its annotations instead. The full branch view is under Security → Code scanning, filtered to pr:1576.

Decisions made autonomously

Scope

• <img src> and other media src values aren't checked, because an image source can't run script. src on script/iframe/frame/embed and data on <object> are checked strictly.
• Declaration files are skipped.
• application/v2_ui/public/vendor/ joins the vendored-asset skip list. That also removes 26 pre-existing classic findings in the vendored bundles.
• .mjs goes through the TypeScript pipeline with JSX off. .js stays on the classic pipeline, even under application/v2_ui/.
• ts-dom-url-property goes beyond the issue's list and covers DOM .href/.src assignments and setAttribute. React-router to is covered too.
• The classic inline-handler, attribute-interpolation and marked.parse checks are ported. jQuery .html( isn't checked in TypeScript files, because V2 has no jQuery.

Precision

• Fail closed: unresolved values are flagged.
• HTML sources: the TypeScript HTML allowlist is stricter than the classic one, and a sanitized value is followed only through useMemo returns.
• Reviewed URL builders: 19 same-origin builders, plus emailDraftMailtoUrl for mailto: URLs in href contexts only. Phase 4's new workflowProposalLink isn't pre-approved: approving a helper that isn't on V2 yet would let later edits to it skip review. The two findings it causes are traced safe above.
• Name-based helpers: helpers named sanitize*, normalize* or safe* and ending in Url/Href/Src/Uri are trusted, following the repo's existing philosophy. Upper-case constants and apiUrl are trusted too.
• Link-level exceptions:
  • A protocol-relative // is accepted in link contexts, because it's an open-redirect concern, not XSS.
  • URL.createObjectURL is accepted in link contexts only.
  • encodeURIComponent(...) is accepted only after a safe prefix.
• Refinements: form receivers, statement guards, useState setter tracking and block scoping. Following parameters to their call sites was left out, and the few parameter-driven findings were traced by hand.

Suppression

• In TypeScript-family files the token needs a same-line justification. Classic behavior is unchanged.

Workflows

• CodeQL runs on push as well as PRs.
• fail_on_findings defaults to false, because full mode reports 355 pre-existing classic findings.
• xss-full-scan.yml changes trigger the XSS self-test.
• The pre-existing tag refs are left alone.
• CHAT_ORCHESTRATION_WORKFLOWS_ROADMAP.md L54–58 is now stale, but that doc is left to the coordinator.

Docs

• The documented python scripts/check_xss_sinks.py --full-file $xssFiles exceeds Windows' 32,767-character command-line limit. The classic list alone is about 47k characters. The feature doc and audit prompt now use a batched loop of 200 files per batch.
• The Broken Access Control and Swagger feature docs note the temporary trigger. The historical fix docs are left alone.

Follow-ups (not in this PR)

• ESLint react/no-danger and react/jsx-no-script-url.
• A shared sanitizeHttpUrl helper.
• Optional justified suppressions on the four sanitized dangerouslySetInnerHTML sites.
• Call-site tracking.
• A CodeQL paths-ignore for vendored bundles, if needed.
• Revert the temporary triggers when V2 merges into Development.

Fixes #1571
Found during #1543