diff --git a/app/modules/catalog/templates/catalog/admin/store-product-detail.html b/app/modules/catalog/templates/catalog/admin/store-product-detail.html index c2b9b4a9..45f9651b 100644 --- a/app/modules/catalog/templates/catalog/admin/store-product-detail.html +++ b/app/modules/catalog/templates/catalog/admin/store-product-detail.html @@ -283,7 +283,7 @@

Description

-
+
diff --git a/app/modules/cms/templates/cms/store/content-page-edit.html b/app/modules/cms/templates/cms/store/content-page-edit.html index 4bc2a021..c57a8ef1 100644 --- a/app/modules/cms/templates/cms/store/content-page-edit.html +++ b/app/modules/cms/templates/cms/store/content-page-edit.html @@ -81,7 +81,7 @@

Title

Content

-
+
{% endcall %} diff --git a/app/modules/dev_tools/templates/dev_tools/admin/components.html b/app/modules/dev_tools/templates/dev_tools/admin/components.html index 751f3eab..0ed33788 100644 --- a/app/modules/dev_tools/templates/dev_tools/admin/components.html +++ b/app/modules/dev_tools/templates/dev_tools/admin/components.html @@ -537,7 +537,7 @@ html {
{# Description Tab #}
-
+

Key Features

    @@ -3174,4 +3174,4 @@ new Chart(document.getElementById('barChart'), barConfig); {% block extra_scripts %} {# ✅ CRITICAL: Load JavaScript file #} -{% endblock %} \ No newline at end of file +{% endblock %} diff --git a/app/modules/marketplace/templates/marketplace/admin/marketplace-product-detail.html b/app/modules/marketplace/templates/marketplace/admin/marketplace-product-detail.html index 94fe1c31..e0950ae4 100644 --- a/app/modules/marketplace/templates/marketplace/admin/marketplace-product-detail.html +++ b/app/modules/marketplace/templates/marketplace/admin/marketplace-product-detail.html @@ -297,7 +297,7 @@
-
+
diff --git a/app/modules/messaging/templates/messaging/admin/notifications.html b/app/modules/messaging/templates/messaging/admin/notifications.html index 97712e62..7d2a3694 100644 --- a/app/modules/messaging/templates/messaging/admin/notifications.html +++ b/app/modules/messaging/templates/messaging/admin/notifications.html @@ -175,7 +175,7 @@ 'bg-blue-100 text-blue-600 dark:bg-blue-900 dark:text-blue-300': notif.priority === 'normal', 'bg-gray-100 text-gray-600 dark:bg-gray-700 dark:text-gray-300': notif.priority === 'low' }"> - +
diff --git a/app/templates/shared/macros/storefront/product-info.html b/app/templates/shared/macros/storefront/product-info.html index 51852994..96a3fe46 100644 --- a/app/templates/shared/macros/storefront/product-info.html +++ b/app/templates/shared/macros/storefront/product-info.html @@ -97,7 +97,7 @@
>
{# Stock Status #} diff --git a/app/templates/shared/macros/storefront/product-tabs.html b/app/templates/shared/macros/storefront/product-tabs.html index cd3fddfb..851982cb 100644 --- a/app/templates/shared/macros/storefront/product-tabs.html +++ b/app/templates/shared/macros/storefront/product-tabs.html @@ -105,7 +105,7 @@
>
{# Features List (if available) #} @@ -380,7 +380,7 @@ diff --git a/docs/proposals/fix-1600-sec015-xhtml-findings.md b/docs/proposals/fix-1600-sec015-xhtml-findings.md index 8f60c7d0..7f7a7416 100644 --- a/docs/proposals/fix-1600-sec015-xhtml-findings.md +++ b/docs/proposals/fix-1600-sec015-xhtml-findings.md @@ -1,7 +1,8 @@ # Fix 1600 SEC-015 x-html Security Info Findings **Date:** 2026-02-15 -**Status:** Planned +**Completed:** 2026-02-16 +**Status:** Implemented **Validator:** Security (`scripts/validate/validate_security.py`) ## Current State diff --git a/docs/proposals/validator-noqa-suppressions-and-remaining-findings.md b/docs/proposals/validator-noqa-suppressions-and-remaining-findings.md index a42a8127..8e881e8c 100644 --- a/docs/proposals/validator-noqa-suppressions-and-remaining-findings.md +++ b/docs/proposals/validator-noqa-suppressions-and-remaining-findings.md @@ -2,7 +2,7 @@ **Date:** 2026-02-14 **Updated:** 2026-02-16 -**Status:** Implemented — noqa mechanism complete, errors and warnings resolved, info findings remain +**Status:** Implemented — noqa mechanism complete, all security findings resolved, performance info remains ## What Was Done @@ -24,11 +24,11 @@ | Validator | Files | Errors | Warnings | Info | |-----------|-------|--------|----------|------| | Architecture | 607 | 0 | 0 | 0 | -| Security | 1323 | 0 | 0 | 1600 | +| Security | 1323 | 0 | 0 | 0 | | Performance | 1195 | 0 | 0 | 1527 | | Audit | 0 | 0 | 2 | 0 | -**Total: 0 errors, 2 warnings, 3127 info** +**Total: 0 errors, 2 warnings, 1527 info** The 2 audit warnings are configuration recommendations (not code issues): @@ -62,15 +62,9 @@ The 2 audit warnings are configuration recommendations (not code issues): --- -## Remaining Info Findings (3127) +## Remaining Info Findings (1527) -All errors and warnings (except 2 audit config recommendations) are resolved. What remains are **info-level** findings only. - -### Security Info (1600 SEC-015) - -| Rule | Count | What | Status | Effort | -|------|-------|------|--------|--------| -| **SEC-015** | 1600 | `x-html` in Alpine.js templates | **Proposal written** — see `fix-1600-sec015-xhtml-findings.md` | Medium | +All errors resolved. All security findings resolved (SEC-015 fix implemented — see `fix-1600-sec015-xhtml-findings.md`). What remains are **performance info** and 2 audit config warnings. ### Performance Info (1527) @@ -86,7 +80,6 @@ All errors and warnings (except 2 audit config recommendations) are resolved. Wh ### Priority Order -1. **Tune SEC-015** to recognize Alpine.js patterns — eliminates 1600 noise findings at the source (proposal ready) -2. **Quick wins**: add `defer` to scripts (PERF-067, 145 findings) and `loading="lazy"` to images (PERF-058, 22 findings) -3. **Fix the 6 fixable noqa** — minor cleanup, do whenever touching those files -4. **Audit config**: add PR template and dependabot config to eliminate 2 remaining warnings +1. **Quick wins**: add `defer` to scripts (PERF-067, 145 findings) and `loading="lazy"` to images (PERF-058, 22 findings) +2. **Fix the 6 fixable noqa** — minor cleanup, do whenever touching those files +3. **Audit config**: add PR template and dependabot config to eliminate 2 remaining warnings diff --git a/scripts/validate/validate_security.py b/scripts/validate/validate_security.py index 400c9969..27a3511e 100755 --- a/scripts/validate/validate_security.py +++ b/scripts/validate/validate_security.py @@ -244,6 +244,13 @@ class SecurityValidator(BaseValidator): if re.search(r'x-html="[^"]*\w', line) and "sanitized" not in line.lower(): if self._is_noqa_suppressed(line, "SEC-015"): continue + # Skip safe Alpine.js patterns — static SVG icons and internal JS methods + if re.search(r'x-html="[^"]*\$icon\(', line): + continue + if re.search(r'x-html="[^"]*\$store\.\w+\.\w+', line): + continue + if re.search(r'x-html="[^"]*window\.icons', line): + continue self._add_violation( rule_id="SEC-015", rule_name="XSS prevention in templates",