Merge pull request #25 from Pr0cella/2.9.0-patch

v2.9.0 CodeQL

Author: Pr0cella

CHANGELOG.md

@@ -22,7 +22,7 @@
 - **Resource loading behavior (visualizer disabled mode)**: STIX Composer and standalone STIX visualizer now avoid loading visualizer-owned and bundled third-party resources when `CONFIG.visualizer.enabled` is `false`.
 
 ### Security
-- **Iframe containment**: Embedded explorer/composer iframes now use sandbox containment (`allow-scripts allow-same-origin`).
+- **Iframe containment**: Embedded explorer/composer iframes now use sandbox containment (`allow-scripts allow-same-origin allow-modals`).
 - **Prototype pollution hardening**: Import parsing/sanitization now blocks dangerous keys (`__proto__`, `constructor`, `prototype`), uses safe JSON reviver parsing, null-prototype object collectors, and own-property checks in dynamic import field mapping.
 
 #### Shared Loader Hardening

docs/IPC_API-DOCS.md

@@ -39,7 +39,7 @@ Bootstrap:
 - Strict allowlists: message types and payload keys are validated; unknown keys/types are rejected.
 - Nonce binding: channel messages must include correct session nonce.
 - Immutable shared data: `AF_SHARED_DATA` is schema-checked, cloned, and deep-frozen.
-- Iframe containment: iframe sandbox is enabled (`allow-scripts allow-same-origin`).
+- Iframe containment: iframe sandbox is enabled (`allow-scripts allow-same-origin allow-modals`).
 - Request throttling: per-frame, per-request-type token-bucket limits (configurable).
 - Channel-only transport: legacy window request/response IPC path removed.
 - Bootstrap resilience: bounded timeout + retry/backoff with terminal failure signaling in child views.

index.html

@@ -4096,7 +4096,8 @@ <h4>Tips</h4>
                     .replace(/>/g, '&gt;')
                     .replace(/"/g, '&quot;')
                     .replace(/'/g, '&#39;')
-                    .replace(/`/g, '&#96;');
+                    .replace(/`/g, '&#96;')
+                    .replace(/\\/g, '&#92;');
             },
 
             // Normalize input: remove control chars, strip script tags, trim, limit length
@@ -4109,7 +4110,6 @@ <h4>Tips</h4>
                 // (see sanitize() and sanitizeForStorage()).  KCE-SEC-010.
                 return String(str)
                     .replace(/[\x00-\x1F\x7F]/g, '')  // Remove control chars
-                    .replace(/<script[^>]*>.*?<\/script>/gi, '')  // Remove script tags
                     .slice(0, maxLength);
             },
 
@@ -4213,7 +4213,6 @@ <h4>Tips</h4>
                 : /[\x00-\x1F\x7F]/g;
             return String(text)
                 .replace(controlPattern, '')
-                .replace(/<script[^>]*>.*?<\/script>/gi, '')
                 .slice(0, maxLength);
         }
 
@@ -4715,8 +4714,8 @@ <h4>Tips</h4>
             const group = (phaseData.groups || []).find(g => g.groupId === groupId);
             if (!group) return;
             group.collapsed = !group.collapsed;
-            const escapedId = window.CSS && CSS.escape ? CSS.escape(groupId) : groupId.replace(/"/g, '\\"');
-            const groupEl = document.querySelector(`.phase-group[data-group-id="${escapedId}"]`);
+            const groupEl = Array.from(document.querySelectorAll('.phase-group'))
+                .find(el => el?.dataset?.groupId === groupId);
             if (groupEl) {
                 groupEl.classList.toggle('collapsed', group.collapsed);
             } else {
@@ -8889,9 +8888,8 @@ <h4>Observables</h4>
                     ? `<span class="phase-details-chip">Group: ${esc(item.groupLabel)}</span>`
                     : '';
 
-                const openAction = item.type === 'custom'
-                    ? `openEntityModal('custom', '${InputSecurity.encodeHtmlEntities(item.id)}', '${InputSecurity.encodeHtmlEntities(phaseKey)}', '${InputSecurity.encodeHtmlEntities(item.instanceId || '')}')`
-                    : `openEntityModal('${escAttr(item.type)}', '${escAttr(item.id)}', '${escAttr(phaseKey)}', '${escAttr(item.instanceId || '')}')`;
+                const encodeInlineJsArg = (value) => InputSecurity.encodeHtmlEntities(JSON.stringify(String(value ?? '')));
+                const openAction = `openEntityModal(${encodeInlineJsArg(item.type)}, ${encodeInlineJsArg(item.id)}, ${encodeInlineJsArg(phaseKey)}, ${encodeInlineJsArg(item.instanceId || '')})`;
 
                 return `
                     <div class="phase-details-item clickable" onclick="${openAction}">
@@ -9432,8 +9430,6 @@ <h4>Observables</h4>
             // Normalize, remove dangerous chars, limit length
             return String(str)
                 .replace(/[\x00-\x1F\x7F]/g, '')  // Control chars
-                .replace(/<script[^>]*>.*?<\/script>/gi, '')  // Script tags
-                .replace(/on\w+\s*=/gi, '')  // Event handlers (onmouseover=, onerror=, etc.)
                 .replace(/[\[\]\{\};"'`]/g, '')  // Blocked chars including double quotes
                 .replace(/--+/g, '')  // SQL comments
                 .replace(/</g, '&lt;').replace(/>/g, '&gt;')  // Encode angle brackets

stix-builder.html

@@ -909,13 +909,13 @@ <h6>Outgoing Edges:</h6>
                     .replace(/>/g, '&gt;')
                     .replace(/"/g, '&quot;')
                     .replace(/'/g, '&#39;')
-                    .replace(/`/g, '&#96;');
+                    .replace(/`/g, '&#96;')
+                    .replace(/\\/g, '&#92;');
             },
             normalize(str, maxLength = 10000) {
                 if (str === null || str === undefined) return '';
                 return String(str)
                     .replace(/[\x00-\x1F\x7F]/g, '')
-                    .replace(/<script[^>]*>.*?<\/script>/gi, '')
                     .slice(0, maxLength);
             },
             sanitize(str, maxLength = 10000) {
@@ -1299,8 +1299,6 @@ <h6>Outgoing Edges:</h6>
             if (typeof str !== 'string') return '';
             return String(str)
                 .replace(/[\x00-\x1F\x7F]/g, '')
-                .replace(/<script[^>]*>.*?<\/script>/gi, '')
-                .replace(/on\w+\s*=/gi, '')
                 .replace(/[\[\]\{\};"'`]/g, '')
                 .replace(/</g, '&lt;').replace(/>/g, '&gt;')
                 .trim()

stix-visualization/index.html

@@ -3,7 +3,6 @@
 
   <head>
     <meta charset="utf-8"/>
-    <link href="../css/cti_flatly_2024-05-07-bootstrap.css" rel="stylesheet">
     <script src="../config.js"></script>
     <script>
       (function configureStixVisualizerAvailability() {