refactor(dotcms-models): enable TypeScript strict mode #35934 - #36879
refactor(dotcms-models): enable TypeScript strict mode #35934#36879nicobytes wants to merge 3 commits into
Conversation
Turn on strict compiler options for the models package and align optional page-render state types with their actual nullability. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Tick the box to add this pull request to the merge queue (same as
|
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.
Suppressed comments (2)
core-web/libs/dotcms-models/tsconfig.json:12
- Issue #35934 acceptance criteria mentions adding dotcms-models
srcto thetypescript-strict-pluginstrictpathsconfig, but this PR only enablesstrictvia the library tsconfig. A repo search fortypescript-strict-plugin/tsc-strictconfiguration undercore-web/returned no matches, so it’s unclear that the plugin-based strict rollout requirement is met (or thatnpx tsc-strictcan pass).
"lib": ["dom", "dom.iterable", "es2022"],
"forceConsistentCasingInFileNames": true,
"strict": true,
"noImplicitOverride": true,
"noPropertyAccessFromIndexSignature": true,
"noImplicitReturns": true,
"noFallthroughCasesInSwitch": true
core-web/libs/dotcms-models/src/lib/dot-rendered-page.model.ts:58
containerMaprebuilds a new object on everyreduceiteration via object spread ({ ...prev, [curr]: ... }), which is avoidable overhead and can be noticeably slower for pages with many containers. A simple loop (or a typed accumulator) builds the map in-place and keeps typing explicit understrict.
const containers = this.containers ?? {};
return Object.keys(containers).reduce(
(prev, curr) => ({
...prev,
[curr]: containers[curr].container
}),
{}
);
…nder Replaced the reduce method with a for...of loop for better readability and performance in the containerMap getter. This change enhances code clarity while maintaining the same functionality.
github-actions
Bot
added
the
Area : Frontend
|
Claude finished @nicobytes's task in 4m 1s —— View job Code Review: Enable TypeScript strict mode on
|
|
Semgrep found 1 Detected a logger that logs user input without properly neutralizing the output. The log message could contain characters like View Dataflow Graphflowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>core-web/libs/sdk/client/src/lib/utils/sdk-compatibility.ts</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/libs/sdk/client/src/lib/utils/sdk-compatibility.ts#L80 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 80] headers</a>"]
end
%% Intermediate
subgraph Traces0[Traces]
direction TB
v2["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/libs/sdk/client/src/lib/utils/sdk-compatibility.ts#L80 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 80] serverVersion</a>"]
v3["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/libs/sdk/client/src/lib/utils/sdk-compatibility.ts#L90 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 90] `</a>"]
end
v2 --> v3
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/libs/sdk/client/src/lib/utils/sdk-compatibility.ts#L89 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 89] console.error(<br> `[dotCMS SDK] SDK ${ownVersion} is not supported by dotCMS ${serverVersion} ` +<br> `(minimum required: ${minSdkVersion}). Upgrade required: ` +<br> 'https://www.dotcms.com/docs/latest/sdk-version-compatibility'<br> )</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
Traces0:::invis
File0:::invis
%% Connections
Source --> Traces0
Traces0 --> Sink
Semgrep found 373
The method identified is susceptible to injection. The input should be validated and properly Semgrep found 110
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. Semgrep found 1 A secret is exposed in the workflow-level Semgrep found 1 Skill instructs the agent to act autonomously without user confirmation, approval, or oversight. Excessive autonomy directives suppress the human-in-the-loop checkpoints that prevent unintended or malicious actions. In legitimate automation skills, user confirmation should be scoped narrowly; blanket directives to "act without asking" are a common pattern in malicious skills that aim to execute payloads silently. Review the full skill context. Semgrep found 1 This .npmrc does not set a minimum release age or sets it too low. Newly published packages can be malicious or unstable. Add Semgrep found 1 Use of Semgrep found 1 Relative path used for script invocation in hook. Use absolute paths or environment variables like $CLAUDE_PROJECT_DIR, $CURSOR_PROJECT_DIR, or $HOME to ensure the correct script is executed regardless of working directory. Semgrep found 6
Using variable interpolation Semgrep found 1 A Semgrep found 1 Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains. View Dataflow Graphflowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>core-web/apps/dotcms-ui-e2e/src/requests/pages.ts</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/apps/dotcms-ui-e2e/src/requests/pages.ts#L76 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 76] request</a>"]
end
%% Intermediate
subgraph Traces0[Traces]
direction TB
v2["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/apps/dotcms-ui-e2e/src/requests/pages.ts#L82 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 82] responseData</a>"]
v3["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/apps/dotcms-ui-e2e/src/requests/pages.ts#L82 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 82] await</a>"]
v4["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/apps/dotcms-ui-e2e/src/requests/pages.ts#L76 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 76] response</a>"]
v5["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/apps/dotcms-ui-e2e/src/requests/pages.ts#L76 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 76] await</a>"]
v6["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/apps/dotcms-ui-e2e/src/requests/pages.ts#L92 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 92] getActionsByContentlet</a>"]
v7["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/apps/dotcms-ui-e2e/src/requests/pages.ts#L92 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 92] await</a>"]
v8["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/apps/dotcms-ui-e2e/src/requests/pages.ts#L92 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 92] actions</a>"]
v9["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/apps/dotcms-ui-e2e/src/requests/pages.ts#L93 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 93] action</a>"]
v10["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/apps/dotcms-ui-e2e/src/requests/pages.ts#L95 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 95] executeAction</a>"]
v11["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/apps/dotcms-ui-e2e/src/requests/pages.ts#L58 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 58] actionId</a>"]
v12["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/apps/dotcms-ui-e2e/src/requests/pages.ts#L59 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 59] endpoint</a>"]
end
v2 --> v3
v3 --> v4
v4 --> v5
v5 --> v6
v6 --> v7
v7 --> v8
v8 --> v9
v9 --> v10
v10 --> v11
v11 --> v12
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/core-web/apps/dotcms-ui-e2e/src/requests/pages.ts#L60 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 60] endpoint</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
Traces0:::invis
File0:::invis
%% Connections
Source --> Traces0
Traces0 --> Sink
Semgrep found 1 Found usage of Vercel's AI product. Semgrep found 1 The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as View Dataflow Graphflowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>dotCMS/src/main/java/com/dotcms/rest/ContentResource.java</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1424 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1424] multipart</a>"]
end
%% Intermediate
subgraph Traces0[Traces]
direction TB
v2["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1424 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1424] multipart</a>"]
v3["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1428 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1428] multipartPUTandPOST</a>"]
v4["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1484 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1484] multipart</a>"]
v5["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1499 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1499] part</a>"]
v6["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1499 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1499] part</a>"]
v7["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1581 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1581] processFile</a>"]
v8["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1613 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1613] part</a>"]
v9["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1616 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1616] badFileName</a>"]
v10["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1617 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1617] filename</a>"]
end
v2 --> v3
v3 --> v4
v4 --> v5
v5 --> v6
v6 --> v7
v7 --> v8
v8 --> v9
v9 --> v10
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1632 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1632] tmpFolder.getAbsolutePath() + File.separator + filename</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
Traces0:::invis
File0:::invis
%% Connections
Source --> Traces0
Traces0 --> Sink
Semgrep found 1
Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path. View Dataflow Graphflowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>dotCMS/src/main/java/com/dotcms/rest/ContentResource.java</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1424 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1424] multipart</a>"]
end
%% Intermediate
subgraph Traces0[Traces]
direction TB
v2["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1424 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1424] multipart</a>"]
v3["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1428 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1428] multipartPUTandPOST</a>"]
v4["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1484 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1484] multipart</a>"]
v5["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1499 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1499] part</a>"]
v6["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1499 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1499] part</a>"]
v7["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1581 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1581] processFile</a>"]
v8["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1613 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1613] part</a>"]
v9["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1616 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1616] badFileName</a>"]
v10["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1617 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1617] filename</a>"]
end
v2 --> v3
v3 --> v4
v4 --> v5
v5 --> v6
v6 --> v7
v7 --> v8
v8 --> v9
v9 --> v10
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/dotCMS/core/blob/bc808432101fcd25e530e89099a459d6982a0419/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1631 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1631] new File(<br> tmpFolder.getAbsolutePath() + File.separator + filename)</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
Traces0:::invis
File0:::invis
%% Connections
Source --> Traces0
Traces0 --> Sink
Semgrep found 1
Detected Semgrep found 3
DNS lookup command uses a variable in the hostname, which could exfiltrate sensitive data via DNS queries. In Claude Code and Cursor hooks, this pattern can leak secrets or environment data to attacker-controlled domains. Use static hostnames only in DNS commands. |
|
Semgrep found 2 Risk: Affected versions of esbuild are vulnerable to Origin Validation Error. esbuild's development server responds to every request, including Server-Sent Events connections, with Manual Review Advice: A vulnerability from this advisory is reachable if you run esbuild with the Fix: Upgrade this library to at least version 0.25.0 at core/core-web/pnpm-lock.yaml:9344. Reference(s): GHSA-67mh-4wv8-2f99 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of js-yaml are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). js-yaml is vulnerable to prototype pollution through its YAML merge key ( Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 4.1.1 at core/starter/nextjs/package-lock.json:3161. Reference(s): GHSA-mh29-5h37-fv8m, CVE-2025-64718 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of webpack are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). webpack's AutoPublicPathRuntimeModule emits runtime code that derives the asset public path from document.currentScript. Because document.currentScript can be DOM-clobbered by an injected scriptless element (e.g. Manual Review Advice: A vulnerability from this advisory is reachable if you build with output.publicPath unset Fix: Upgrade this library to at least version 5.94.0 at core/core-web/pnpm-lock.yaml:15048. Reference(s): GHSA-4vvj-4cpr-p986, CVE-2024-43788 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of next are vulnerable to Improper Input Validation. Next.js Image Optimization ( Manual Review Advice: A vulnerability from this advisory is reachable if you are using next/image and either Fix: Upgrade this library to at least version 14.2.31 at core/core-web/pnpm-lock.yaml:11820. Reference(s): GHSA-xv57-4mr9-wg8v, CVE-2025-55173 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of next are vulnerable to Allocation of Resources Without Limits or Throttling. An attacker can send a Server Action request with an abruptly closed connection or invalid Content-Length header, causing the internal React Flight Reply decoder to create perpetually-pending promise chunks that never resolve. This leaves the server connection hanging indefinitely until the hosting provider times out execution, resulting in a denial of service. Manual Review Advice: A vulnerability from this advisory is reachable if you use Server Actions ("use server") without enforcing request timeouts or connection termination Fix: Upgrade this library to at least version 14.2.21 at core/core-web/pnpm-lock.yaml:11820. Reference(s): GHSA-7m27-7ghc-44w9, CVE-2024-56332 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of next are vulnerable to Uncontrolled Recursion. An attacker can send a crafted HTTP request to the built-in Next.js image optimization endpoint ( Manual Review Advice: A vulnerability from this advisory is reachable if you have default image optimization configured on non Vercel hosting Fix: Upgrade this library to at least version 14.2.7 at core/core-web/pnpm-lock.yaml:11820. Reference(s): GHSA-g77x-44xx-532m, CVE-2024-47831 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of next are vulnerable to Improper Input Validation. Next.js Image Optimization ( Fix: Upgrade this library to at least version 14.2.31 at core/starter/nextjs/package-lock.json:3428. Reference(s): GHSA-xv57-4mr9-wg8v, CVE-2025-55173 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of next are vulnerable to Server-Side Request Forgery (SSRF). This Next.js config defines a Manual Review Advice: A vulnerability from this advisory is reachable if you define a rewrites() or redirects() rule in next.config.js whose destination hostname is assembled from a dynamic :param segment Fix: Upgrade this library to at least version 15.5.21 at core/core-web/pnpm-lock.yaml:11820. Reference(s): GHSA-p9j2-gv94-2wf4 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of next are vulnerable to Excessive Iteration. Next.js App Router validates multi-page-application (MPA) form submissions by iterating over every Manual Review Advice: A vulnerability from this advisory is reachable if you are using the App Router with at least one Server Action Fix: Upgrade this library to at least version 15.5.21 at core/core-web/pnpm-lock.yaml:11820. Reference(s): GHSA-m99w-x7hq-7vfj If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 3
Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. An attacker can supply a YAML document containing a chain of mappings that each merge the previous one via the merge key ( Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 3.15.0 at core/.github/scripts/release-qa-status/package-lock.json:3105. Reference(s): GHSA-52cp-r559-cp3m, CVE-2026-59869 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of vite and vite-plus are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Vite's server.fs.deny blocklist—which protects sensitive files such as .env and certificate files from being served—can be bypassed on Windows using alternate path representations (NTFS Alternate Data Stream syntax like Manual Review Advice: A vulnerability from this advisory is reachable if you expose the Vite dev server or vite-plus to the network by configuring a non-loopback address using the --host CLI flag on Windows Fix: Upgrade this library to at least version 7.3.5 at core/core-web/pnpm-lock.yaml:14756. Reference(s): GHSA-fx2h-pf6j-xcff, CVE-2026-53571 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of axios are vulnerable to Inefficient Regular Expression Complexity / Uncontrolled Resource Consumption. axios is vulnerable to a regular expression denial of service (ReDoS). The internal Manual Review Advice: A vulnerability from this advisory is reachable if you are using axios in browser with untrusted Fix: Upgrade this library to at least version 1.16.0 at core/core-web/pnpm-lock.yaml:7832. Reference(s): GHSA-hfxv-24rg-xrqf If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of axios are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') / Unintended Proxy or Intermediary ('Confused Deputy'). axios reads Manual Review Advice: A vulnerability from this advisory is reachable if you use axios to make HTTP requests Fix: Upgrade this library to at least version 1.16.0 at core/core-web/pnpm-lock.yaml:7832. Reference(s): GHSA-35jp-ww65-95wh, GHSA-fvcv-3m26-pcqx, CVE-2026-44494 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of next are vulnerable to Allocation of Resources Without Limits or Throttling. An attacker can send a specially crafted HTTP request to any Next.js App Router Server Function endpoint that, when deserialized by the underlying React Server Components (Flight) runtime, triggers excessive CPU usage—exhausting the server process and resulting in a denial-of-service. The vulnerable deserialization path is part of the App Router's HTTP route handler, so any Next.js application that uses the App Router is reachable without any explicit Server Action declared in user code. Manual Review Advice: A vulnerability from this advisory is reachable if you are using the App Router Fix: Upgrade this library to at least version 15.5.16 at core/core-web/pnpm-lock.yaml:11820. Reference(s): GHSA-8h8q-6873-q5fj, CVE-2026-23870 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of next are vulnerable to Server-Side Request Forgery (SSRF). Next.js's standalone router-server forwards WebSocket Manual Review Advice: A vulnerability from this advisory is reachable if you self-host Next.js application instead of Vercel-hosted deployments Fix: Upgrade this library to at least version 15.5.16 at core/core-web/pnpm-lock.yaml:11820. Reference(s): GHSA-c4j6-fc7j-m34r, CVE-2026-44578 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of next are vulnerable to Allocation of Resources Without Limits or Throttling. A specially crafted HTTP request to a Next.js App Router Server Function endpoint can trigger excessive CPU consumption during React Server Components deserialization, leading to denial of service. Fix: Upgrade this library to at least version 15.5.15 at core/core-web/pnpm-lock.yaml:11820. Reference(s): GHSA-q4gf-8mx6-v5v3 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2
Risk: Affected versions of handlebars are vulnerable to Improper Control of Generation of Code ('Code Injection') / Improper Encoding or Escaping of Output / Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The Handlebars CLI precompiler allows arbitrary JavaScript injection by embedding unescaped template filenames and CLI option values such as Manual Review Advice: A vulnerability from this advisory is reachable if you execute templates through the Handlebars CLI precompiler Fix: Upgrade this library to at least version 4.7.9 at core/dotcms-postman/pnpm-lock.yaml:197. Reference(s): GHSA-xjpj-3mr7-gcpf, CVE-2026-33941 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of rollup are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rollup is vulnerable to arbitrary file write via path traversal: chunk/asset names derived from user-controlled inputs (e.g., CLI named inputs, manual chunk aliases, or malicious plugins) are insufficiently sanitized, allowing Manual Review Advice: A vulnerability from this advisory is reachable if you are running Fix: Upgrade this library to at least version 4.59.0 at core/core-web/pnpm-lock.yaml:13456. Reference(s): GHSA-mw96-cpmx-2vgc, CVE-2026-27606 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of next are vulnerable to Deserialization of Untrusted Data / Uncontrolled Resource Consumption. A flaw in React Server Components' deserialization allows an attacker to send a specially crafted HTTP request to any App Router Server Function endpoint in Next.js, triggering excessive CPU usage, out-of-memory conditions, or a server crash and resulting in a denial of service. Fix: Upgrade this library to at least version 15.0.8 at core/core-web/pnpm-lock.yaml:11820. Reference(s): GHSA-h25m-26qc-wcjf, CVE-2026-23864 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of next are vulnerable to Dependency on Vulnerable Third-Party Component / Deserialization of Untrusted Data / Uncontrolled Resource Consumption. An attacker can send a specially crafted HTTP request to any Server Function endpoint (as used by Next.js' App Router) that, when deserialized by the React Server Components runtime, enters an infinite loop—hanging the server process, exhausting CPU, and resulting in a denial-of-service. Fix: Upgrade this library to at least version 14.2.35 at core/core-web/pnpm-lock.yaml:11820. Reference(s): GHSA-5j59-xgg2-r9c4, CVE-2025-67779 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of next are vulnerable to Dependency on Vulnerable Third-Party Component / Deserialization of Untrusted Data / Uncontrolled Resource Consumption. A flaw in Next.js's App Router deserialization allows an attacker to send a specially crafted HTTP request body that, when parsed by the server, triggers excessive CPU work or an infinite loop. By targeting any App Router endpoint with this malicious payload, the server process can hang and become unresponsive, resulting in a denial-of-service. Fix: Upgrade this library to at least version 14.2.34 at core/core-web/pnpm-lock.yaml:11820. Reference(s): GHSA-mwv6-3258-q52c If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of rollup are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Manual Review Advice: A vulnerability from this advisory is reachable if you use Rollup to bundle JavaScript with Fix: Upgrade this library to at least version 4.22.4 at core/core-web/pnpm-lock.yaml:13456. Reference(s): GHSA-gcx4-mw62-g8wm, CVE-2024-47068 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of axios are vulnerable to Insertion of Sensitive Information Into Sent Data. The Node.js HTTP adapter in axios fails to clear the Proxy-Authorization header when a request that initially used an authenticated HTTP proxy is redirected to a target requiring no proxy (e.g. an HTTP-to-HTTPS redirect with no HTTPS proxy configured), leaking the proxy credentials to the final origin server. Manual Review Advice: A vulnerability from this advisory is reachable if you make requests with the Node.js HTTP adapter through an authenticated HTTP proxy with redirect following enabled Fix: Upgrade this library to at least version 1.16.0 at core/core-web/pnpm-lock.yaml:7832. Reference(s): GHSA-p92q-9vqr-4j8v, CVE-2026-44487 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of axios are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The Node.js HTTP adapter in axios leaks authenticated proxy credentials when following redirects. When a request traverses an authenticated proxy and is then redirected to a URL that no longer routes through that proxy, the stale Manual Review Advice: A vulnerability from this advisory is reachable if you use axios in Node.js with an authenticated proxy configured via the Fix: Upgrade this library to at least version 1.16.0 at core/core-web/pnpm-lock.yaml:7832. Reference(s): GHSA-j5f8-grm9-p9fc, CVE-2026-44486 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of axios are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') / Unintended Proxy or Intermediary ('Confused Deputy'). axios reads Fix: Upgrade this library to at least version 1.16.0 at core/core-web/pnpm-lock.yaml:7832. Reference(s): GHSA-35jp-ww65-95wh, GHSA-fvcv-3m26-pcqx, CVE-2026-44494 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of axios are vulnerable to Improper Control of Generation of Code ('Code Injection') / Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). axios contains a prototype-pollution gadget in its config merge pipeline. If Object.prototype.transformResponse is polluted by a separate vulnerability in the same process, mergeConfig() reads it through the prototype chain and transformData() executes the inherited function on every HTTP response body, enabling credential theft and response hijacking. Every axios HTTP call traverses this pipeline. Upgrade to 0.31.1, 1.15.2, or later. Fix: Upgrade this library to at least version 1.15.2 at core/core-web/pnpm-lock.yaml:7832. Reference(s): GHSA-3g43-6gmg-66jw, CVE-2026-44495 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of axios are vulnerable to Authentication Bypass by Alternate Name / Server-Side Request Forgery (SSRF). Axios does not normalize IPv4-mapped IPv6 addresses before applying Manual Review Advice: A vulnerability from this advisory is reachable if you have a proxy configured via Fix: Upgrade this library to at least version 1.16.0 at core/core-web/pnpm-lock.yaml:7832. Reference(s): GHSA-pjwm-pj3p-43mv, CVE-2025-62718, CVE-2026-44492 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of axios are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). An attacker can exploit this vulnerability by polluting Object.prototype via another dependency in the same Node.js process. Axios reads five HTTP adapter config properties (auth, baseURL, socketPath, beforeRedirect, insecureHTTPParser) via direct property access without hasOwnProperty guards, so the polluted values are silently picked up on every outbound HTTP request. This enables Authorization header credential injection, request hijacking via baseURL redirection, SSRF to internal Unix sockets, attacker-controlled callback execution during redirects, and request smuggling via the insecure HTTP parser. Fix: Upgrade this library to at least version 1.15.2 at core/core-web/pnpm-lock.yaml:7832. Reference(s): GHSA-q8qp-cvcw-x6jj, CVE-2026-42264 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of axios are vulnerable to Permissive List of Allowed Inputs / Server-Side Request Forgery (SSRF) / Unintended Proxy or Intermediary ('Confused Deputy'). Axios contains an incomplete fix for CVE-2025-62718. The internal Manual Review Advice: A vulnerability from this advisory is reachable if you use Axios in Node.js with a proxy configured via the Fix: Upgrade this library to at least version 1.15.1 at core/core-web/pnpm-lock.yaml:7832. Reference(s): GHSA-pmwg-cvhr-8vh7, CVE-2026-42043 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of axios are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). Axios do not guard reads of config properties (e.g. Fix: Upgrade this library to at least version 1.15.1 at core/core-web/pnpm-lock.yaml:7832. Reference(s): GHSA-pf86-5x62-jrwf, CVE-2026-42033 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of vitest are vulnerable to Missing Authorization. When the Vitest UI server is listening, the deprecated isFileServingAllowed check is applied without normalizing the URL before filesystem operations, allowing path traversal that lets an attacker read, write, and execute arbitrary files outside the project directory. Manual Review Advice: A vulnerability from this advisory is reachable if you run the Vitest UI on Windows, or you expose the Vitest UI server to the network with the --api.host flag or api.host config option Fix: Upgrade this library to at least version 4.1.0 at core/core-web/pnpm-lock.yaml:14839. Reference(s): GHSA-5xrq-8626-4rwp If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: webpack 5.x before 5.76.0 is vulnerable to Improper Access Control due to ImportParserPlugin.js mishandling the magic comment feature. Due to this, webpack does not avoid cross-realm object access and an attacker who controls a property of an untrusted object can obtain access to the real global object. Manual Review Advice: A vulnerability from this advisory is reachable if you host an application utilizing webpack and an attacker can control a property of an untrusted object Fix: Upgrade this library to at least version 5.76.0 at core/core-web/pnpm-lock.yaml:15048. Reference(s): GHSA-hc6q-2mpp-qw7j, CVE-2023-28154 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
Summary
strict(and related flags) ondotcms-modelswithout changingtsconfig.base.json.DotPageRender/DotPageRenderStateoptional getters and state fields with real nullability.unknown-block.utilindex-signature and possibly-undefined access under strict.Closes #35934
Test plan
pnpm exec tsc -p libs/dotcms-models/tsconfig.lib.json --noEmit(0 errors)pnpm nx run dotcms-models:lintMade with Cursor