-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathosv-scanner.toml
More file actions
94 lines (81 loc) · 4.09 KB
/
Copy pathosv-scanner.toml
File metadata and controls
94 lines (81 loc) · 4.09 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
# OSV-Scanner configuration for DOMFortify.
#
# DOMFortify ships zero runtime dependencies, so the published artifact has no
# supply-chain surface of its own. Any advisories OSV-Scanner reports come from
# development / test / CI tooling in the lockfile, never from distributed code.
#
# Most suppressions below are for deliberately-vulnerable legacy libraries
# pulled in ONLY as e2e test fixtures (test/fixtures/with-angularjs.html and
# test/fixtures/with-jquery.html). They are intentionally old: the tests exist
# to prove DOMFortify backstops their known DOM-XSS sinks, so "upgrade to fix"
# is not an option - a patched version would no longer exercise the footgun.
# devDependencies only; never part of the published runtime artifact.
#
# Each entry carries a one-year ignoreUntil so it is re-evaluated, not buried.
# --- AngularJS 1.8.3 (EOL, terminal - no fixed 1.x release exists) -----------
# Fixture: test/fixtures/with-angularjs.html (ng-bind-html without ngSanitize).
[[IgnoredVulns]]
id = "GHSA-2qqx-w9hr-q5gx"
ignoreUntil = 2027-06-22
reason = "AngularJS 1.8.3 EOL; dev-only test fixture, not in the published runtime artifact."
[[IgnoredVulns]]
id = "GHSA-2vrf-hf26-jrp5"
ignoreUntil = 2027-06-22
reason = "AngularJS 1.8.3 EOL; dev-only test fixture, not in the published runtime artifact."
[[IgnoredVulns]]
id = "GHSA-4w4v-5hc9-xrr2"
ignoreUntil = 2027-06-22
reason = "AngularJS 1.8.3 EOL; dev-only test fixture, not in the published runtime artifact."
# CVE-2026-11998 (SCE resource-URL policy bypass), published 2026-06-24 - after
# this block was written. Same terminal situation: AngularJS is EOL, no fixed
# release exists or will exist, and the fixture must stay vulnerable by design.
[[IgnoredVulns]]
id = "GHSA-7x27-g8rg-x87w"
ignoreUntil = 2027-06-22
reason = "AngularJS 1.8.3 EOL; dev-only test fixture, not in the published runtime artifact."
[[IgnoredVulns]]
id = "GHSA-j58c-ww9w-pwp5"
ignoreUntil = 2027-06-22
reason = "AngularJS 1.8.3 EOL; dev-only test fixture, not in the published runtime artifact."
[[IgnoredVulns]]
id = "GHSA-m2h2-264f-f486"
ignoreUntil = 2027-06-22
reason = "AngularJS 1.8.3 EOL; dev-only test fixture, not in the published runtime artifact."
[[IgnoredVulns]]
id = "GHSA-m9gf-397r-hwpg"
ignoreUntil = 2027-06-22
reason = "AngularJS 1.8.3 EOL; dev-only test fixture, not in the published runtime artifact."
[[IgnoredVulns]]
id = "GHSA-mqm9-c95h-x2p6"
ignoreUntil = 2027-06-22
reason = "AngularJS 1.8.3 EOL; dev-only test fixture, not in the published runtime artifact."
[[IgnoredVulns]]
id = "GHSA-prc3-vjfx-vhm9"
ignoreUntil = 2027-06-22
reason = "AngularJS 1.8.3 EOL; dev-only test fixture, not in the published runtime artifact."
[[IgnoredVulns]]
id = "GHSA-qwqh-hm9m-p5hr"
ignoreUntil = 2027-06-22
reason = "AngularJS 1.8.3 EOL; dev-only test fixture, not in the published runtime artifact."
# --- jQuery 3.4.1 (deliberately pre-3.5: CVE-2020-11022 / -11023 mXSS) -------
# Fixture: test/fixtures/with-jquery.html ($(t).html() reaching innerHTML).
# Bumping to >= 3.5.0 would patch the very sink the test relies on.
[[IgnoredVulns]]
id = "GHSA-gxr4-xjj5-5px2"
ignoreUntil = 2027-06-22
reason = "jQuery 3.4.1 pinned pre-3.5 on purpose for the mXSS backstop test; dev-only, not shipped."
[[IgnoredVulns]]
id = "GHSA-jpcq-cgw6-v4j6"
ignoreUntil = 2027-06-22
reason = "jQuery 3.4.1 pinned pre-3.5 on purpose for the mXSS backstop test; dev-only, not shipped."
# --- js-yaml 3.14.2 (transitive, via nyc coverage tooling) ------------------
# Path: nyc -> @istanbuljs/load-nyc-config -> js-yaml@3.14.2. Not a fixture and
# not deliberately old - just what nyc pins. dev-only (npm audit --omit=dev is
# clean); never in the published zero-dependency runtime artifact. Cannot be
# forward-fixed here: the patched js-yaml is >= 4.2.0, but load-nyc-config calls
# the 3.x safeLoad API that 4.x removed, so an override breaks coverage. The DoS
# also requires parsing attacker-controlled YAML; nyc only reads our own .nycrc.
[[IgnoredVulns]]
id = "GHSA-h67p-54hq-rp68"
ignoreUntil = 2027-06-22
reason = "js-yaml 3.14.2 via nyc coverage tooling; dev-only, not shipped, no forward fix (4.x drops the safeLoad API nyc uses)."