[B2] Adjudicate open CodeQL security alerts (html-escape, sanitize, static-serve, sitemap)

[SisyphusZheng]

Surfaced during the Beta.1 dev→main promotion (PR #1280, 2026-09-03): CodeQL diff-scan reported "7 new alerts including 5 high severity" purely because the promotion diff is the entire v0.44 train. Investigation shows the underlying alerts are pre-existing and open on main (created 2026-08-01 through 2026-08-22, i.e. they ship in stable 0.43.3):

• #4140/#4142/#4143/#4144 — packages/element/src/internal/core/html-escape.ts (bad-tag-filter / incomplete-multi-character-sanitization, on main since Aug 8–9)
• #4151 — www/app/site-ui/article-body.ts (incomplete-multi-character-sanitization, on main since Aug 22)
• #4150 — packages/adapter-vite/src/internal/static-serve.ts (file-system race, Aug 17)
• #4148/#4149 — packages/adapter-vite/src/internal/content/sitemap/generator.ts (insecure temporary file, Aug 17)
• #4131 — tools/check-public-docs-integrity.ts (incomplete sanitization, Aug 1)
• #4145 — tools/autoflow/__tests__/release.test.ts (template syntax in string literal, Aug 16)
• #4170 — packages/app/__tests__/spa-projection-guard.test.ts (useless assignment, warning, new v0.44 test file)

Beta.1 decision: NOT a release blocker — no new exposure versus the published stable; security-projection suites (escape parity, sanitizer, static-output freeze) are green at the qualified candidate dc3ee191. But these must be adjudicated properly in Beta.2 hardening: for each alert either fix, or dismiss with a documented reason (several look like deliberate contract code, e.g. entity-preserving sanitizer escapes; CodeQL regex heuristics misfire on those).

Part of #1155. Recorded as a known exception in the Beta.1 release evidence.

[SisyphusZheng]

Adjudication complete in PR #1291 (branch fix/1281-codeql-alert-adjudication, commit 094c1c2). Live alert state was re-fetched via gh api repos/open-element/openelement/code-scanning/alerts?state=open and matched the issue list exactly (11 alerts).

Fixed (8) — with regression tests, security-projection suites green (escape parity / sanitizer / static-output-freeze self-check):

• #4143, #4144, #4140, #4142 — packages/element/src/internal/core/html-escape.ts: headExtras script strip now runs the block pass to a fixed point before the strip-to-EOF backstop; script end-tag pattern accepts attributes/whitespace per the HTML spec (</script\t\n bar>); on* attribute strip runs to a fixed point (a single pass could concatenate o + nclick=… into a live onclick); comment-balance check counts --!>. Contract preserved — everything previously stripped is still stripped; new tests prove the adversarial residuals are gone and ordinary content is untouched.
• #4151 — www/app/site-ui/article-body.ts: heading labels drop stray </> so a partial-tag fragment can never reach the rail outline.
• #4150 — packages/adapter-vite/src/internal/static-serve.ts: tryStatic reads candidates directly (failure-as-miss) instead of existsSync/statSync guard-then-read TOCTOU; mirrored in the generated serve.mjs template; verified end-to-end by the regenerated-fixture HTTP contract test.
• #4131 — tools/check-public-docs-integrity.ts: prerelease tag embedded via the shared escapeRegExp; provably behavior-identical for the constrained tag shape (parity pinned by test).
• #4170 — packages/app/__tests__/spa-projection-guard.test.ts: always-overwritten initializer removed.

Dismissed (3) — recorded on the alerts via gh api (visible rationale):

• #4145 (used in tests): the flagged string is intentional fixture data in tools/autoflow/__tests__/release.test.ts mirroring the real project-constants.ts line PACKAGE_VERSION_TAG = `v${PACKAGE_VERSION}` as input to bumpProjectConstantsText; it must not interpolate, and rewriting it would reduce fixture fidelity.
• #4148 / #4149 (false positive): sitemap.xml/robots.txt writes target the developer's own SSG output dir (not a shared temp dir), pin mode: 0o644, and require truncate-overwrite on rebuild (O_EXCL would break regeneration). The only os.tmpdir() dataflow comes from test fixtures (sitemap-generator.test.ts).

The 8 fixed alerts will auto-close on the next CodeQL scan of dev after merge; the full per-alert table, evidence, and risk notes are in the PR body.

[SisyphusZheng]

Adjudicated by PR #1291 (squash-merged to dev as 493cf2ad). Per-alert verdicts (durable rationale also in the PR body):

Fixed (8): #4140/#4142/#4143/#4144 html-escape.ts (fixed-point script-block strip with spec-accurate end-tag pattern; fixed-point on*-handler strip; --!> counted as comment close — safe-direction, everything previously stripped still stripped, RED-proven adversarial tests); #4151 article-body.ts (fixed-point tag strip; CodeQL re-scan closed the residual round-1 alert as fixed); #4150 static-serve.ts (TOCTOU guard-then-read → read-with-failure-as-miss, mirrored in generated serve.mjs); #4131 check-public-docs-integrity.ts (shared escapeRegExp); #4170 spa-projection-guard.test.ts (dead initializer removed).

Dismissed (3): #4148/#4149 sitemap/generator.ts — false positive (developer-owned dist dir, 0o644 pinned, overwrite-on-rebuild required); #4145 release.test.ts — used-in-tests (intentional fixture literal).

Important mechanics note: GitHub only auto-closes 'fixed' alerts when the analysis runs on the DEFAULT branch (main). The 8 fixed alerts remain open until the fix reaches main at the Beta.2 promotion; the 3 dismissals are already effective. Closure gate added to stage #1288: after the beta.2 main promotion, verify open CodeQL alerts == 0.

CI green at merge; freeze:semantics:check green (no frozen path touched); pack:dry-run + package-artifacts:check green; security-projection suites green.