A package address reaches src as text, and CodeQL files the same alerts after every change #71

CodeQL flags every setAttribute('src', …) whose value comes from a link, a text field or the cmi5 launch, under js/xss, js/xss-through-dom and js/client-side-unvalidated-url-redirection. 22 such alerts were dismissed as false positives between 2026-10-06 and 2026-10-18. Each is filed again once a line around it moves, and #70 drew a new one (alert 35, the preview page).

They are false positives for the element: <h5p-player> fetches its src and never navigates to it. But nothing keeps a javascript: or data: address out of src either, and dismissing the same alert again after each change fixes nothing.

Where an address from outside reaches src:

• apps/demo/demo/player-page.js: the URL field, the samples and ?src=
• apps/demo/demo/cmi5-page.js: ?src= and launchParameters
• apps/demo/app/app.js: ?src= and launch links, parsed already, any scheme accepted
• packages/embed/site/embed.js: ?src=
• packages/cmi5/src/index.ts: startCmi5's default src, the address's ?src= and then launchParameters
• packages/verify/lib/preview.html: fixed in feat: h5p-verify --preview, a package in the real player in your browser #70

The fix the alert suggests: resolve the address with new URL, accept only http: and https:, set the parsed URL's href, and say what was refused.