-
Notifications
You must be signed in to change notification settings - Fork 480
Migrate(edit Content): Portlet UI to primeng angular 21 V2 #34433
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: issue-33882-primeng-update
Are you sure you want to change the base?
Migrate(edit Content): Portlet UI to primeng angular 21 V2 #34433
Conversation
…nd overlays for better UI interaction
| @@ -63,6 +62,9 @@ import { | |||
| DotMessagePipe | |||
| ], | |||
| changeDetection: ChangeDetectionStrategy.OnPush, | |||
| host: { | |||
| class: 'block h-fit' | |||
| }, | |||
| viewProviders: [ | |||
| { | |||
| provide: ControlContainer, | |||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
High severity and reachable issue identified in your code:
Line 48 has a vulnerable usage of @angular/compiler, introducing a high severity vulnerability.
ℹ️ Why this is reachable
A reachable issue is a real security risk because your project actually executes the vulnerable code. This issue is reachable because your code uses a certain version of @angular/compiler.
Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the href and xlink:href attributes on SVG <script> elements as Resource URL contexts. This allows an attacker to bind a malicious data: URI or external script via [attr.href] or [attr.xlink:href], resulting in arbitrary JavaScript execution (XSS) in the victim's browser.
To resolve this comment:
Upgrade this dependency to at least version 21.0.7 at core-web/package-lock.json.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
If this is a critical or high severity finding, please also link this issue in the #security channel in Slack.
You can view more details on this finding in the Semgrep AppSec Platform here.
| @Component({ | ||
| selector: 'dot-edit-content-sidebar-locales', | ||
| imports: [ChipModule, SkeletonModule, DotIsoCodePipe], | ||
| imports: [ButtonModule, OverlayBadgeModule, SkeletonModule, DotIsoCodePipe], | ||
| templateUrl: './dot-edit-content-sidebar-locales.component.html', | ||
| styleUrl: './dot-edit-content-sidebar-locales.component.scss', | ||
| changeDetection: ChangeDetectionStrategy.OnPush |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
High severity and reachable issue identified in your code:
Line 31 has a vulnerable usage of @angular/compiler, introducing a high severity vulnerability.
ℹ️ Why this is reachable
A reachable issue is a real security risk because your project actually executes the vulnerable code. This issue is reachable because your code uses a certain version of @angular/compiler.
Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the href and xlink:href attributes on SVG <script> elements as Resource URL contexts. This allows an attacker to bind a malicious data: URI or external script via [attr.href] or [attr.xlink:href], resulting in arbitrary JavaScript execution (XSS) in the victim's browser.
To resolve this comment:
Upgrade this dependency to at least version 21.0.7 at core-web/package-lock.json.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
If this is a critical or high severity finding, please also link this issue in the #security channel in Slack.
You can view more details on this finding in the Semgrep AppSec Platform here.
Legal RiskThe following dependencies were released under a license that RecommendationWhile merging is not directly blocked, it's best to pause and consider what it means to use this license before continuing. If you are unsure, reach out to your security team or Semgrep admin to address this issue. GPL-2.0 MPL-2.0
|
|
Semgrep found 2
Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the Fix: Upgrade this library to at least version 21.0.7 at core/core-web/package-lock.json:5082. Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
| @Component({ | ||
| selector: 'dot-language-variable-selector', | ||
| imports: [AutoCompleteModule, FormsModule, DotMessagePipe, DotHighlightPipe], | ||
| imports: [ | ||
| AutoCompleteModule, | ||
| FormsModule, | ||
| DotMessagePipe, | ||
| DotHighlightPipe, | ||
| IconFieldModule, | ||
| InputIconModule | ||
| ], | ||
| templateUrl: './dot-language-variable-selector.component.html', | ||
| styleUrl: './dot-language-variable-selector.component.scss', | ||
| changeDetection: ChangeDetectionStrategy.OnPush | ||
| changeDetection: ChangeDetectionStrategy.OnPush, | ||
| host: { | ||
| class: 'block w-[256px]' | ||
| } | ||
| }) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
High severity and reachable issue identified in your code:
Line 58 has a vulnerable usage of @angular/compiler, introducing a high severity vulnerability.
ℹ️ Why this is reachable
A reachable issue is a real security risk because your project actually executes the vulnerable code. This issue is reachable because your code uses a certain version of @angular/compiler.
Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the href and xlink:href attributes on SVG <script> elements as Resource URL contexts. This allows an attacker to bind a malicious data: URI or external script via [attr.href] or [attr.xlink:href], resulting in arbitrary JavaScript execution (XSS) in the victim's browser.
To resolve this comment:
Upgrade this dependency to at least version 21.0.7 at core-web/package-lock.json.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
If this is a critical or high severity finding, please also link this issue in the #security channel in Slack.
You can view more details on this finding in the Semgrep AppSec Platform here.
| @Component({ | ||
| selector: 'dot-card-field-label', | ||
| imports: [TooltipModule], | ||
| styleUrl: './dot-card-field-label.component.scss', | ||
| templateUrl: './dot-card-field-label.component.html', | ||
| changeDetection: ChangeDetectionStrategy.OnPush | ||
| }) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
High severity and reachable issue identified in your code:
Line 19 has a vulnerable usage of @angular/compiler, introducing a high severity vulnerability.
ℹ️ Why this is reachable
A reachable issue is a real security risk because your project actually executes the vulnerable code. This issue is reachable because your code uses a certain version of @angular/compiler.
Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the href and xlink:href attributes on SVG <script> elements as Resource URL contexts. This allows an attacker to bind a malicious data: URI or external script via [attr.href] or [attr.xlink:href], resulting in arbitrary JavaScript execution (XSS) in the victim's browser.
To resolve this comment:
Upgrade this dependency to at least version 21.0.7 at core-web/package-lock.json.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
If this is a critical or high severity finding, please also link this issue in the #security channel in Slack.
You can view more details on this finding in the Semgrep AppSec Platform here.
|
Semgrep found 3
Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the Fix: Upgrade this library to at least version 21.0.7 at core/core-web/package-lock.json:5082. Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
…component templates
…e styles and remove unused SCSS files
|
Semgrep found 3
Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the Fix: Upgrade this library to at least version 21.0.7 at core/core-web/package-lock.json:5082. Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
…yles for relationship field
|
Semgrep found 3
Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the Fix: Upgrade this library to at least version 21.0.7 at core/core-web/package-lock.json:5082. Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
|
Semgrep found 2
Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the Fix: Upgrade this library to at least version 21.0.7 at core/core-web/package-lock.json:5082. Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
|
Semgrep found 5
Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the Fix: Upgrade this library to at least version 21.0.7 at core/core-web/package-lock.json:5082. Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
|
Semgrep found 1
Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the Fix: Upgrade this library to at least version 21.0.7 at core/core-web/package-lock.json:5082. Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
…exbox for improved usability
…meng-angular-21-v2' of https://github.com/dotCMS/core into issue-34414-task-migrate-edit-cotnent-portlet-ui-to-primeng-angular-21-v2
… and enhance scroll handling
…ents for improved readability
| @@ -110,7 +110,10 @@ import { DotEditContentFieldComponent } from '../dot-edit-content-field/dot-edit | |||
| animate('250ms ease-in', style({ opacity: 1 })) | |||
| ]) | |||
| ]) | |||
| ] | |||
| ], | |||
| host: { | |||
| class: 'min-w-0 max-w-full overflow-auto overflow-x-hidden' | |||
| }, | |||
| }) | |||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
High severity and reachable issue identified in your code:
Line 88 has a vulnerable usage of @angular/compiler, introducing a high severity vulnerability.
ℹ️ Why this is reachable
A reachable issue is a real security risk because your project actually executes the vulnerable code. This issue is reachable because your code uses a certain version of @angular/compiler.
Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the href and xlink:href attributes on SVG <script> elements as Resource URL contexts. This allows an attacker to bind a malicious data: URI or external script via [attr.href] or [attr.xlink:href], resulting in arbitrary JavaScript execution (XSS) in the victim's browser.
To resolve this comment:
Upgrade this dependency to at least version 21.0.7 at core-web/package-lock.json.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
If this is a critical or high severity finding, please also link this issue in the #security channel in Slack.
You can view more details on this finding in the Semgrep AppSec Platform here.
…ard field layout for better structure
…ponent for improved styling and responsiveness
|
Semgrep found 6
Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the Fix: Upgrade this library to at least version 21.0.7 at core/core-web/package-lock.json:5082. Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
…for improved code consistency
…meng-angular-21-v2' of https://github.com/dotCMS/core into issue-34414-task-migrate-edit-cotnent-portlet-ui-to-primeng-angular-21-v2
|
Semgrep found 3
Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the Fix: Upgrade this library to at least version 21.0.7 at core/core-web/package-lock.json:5082. Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
This PR fixes: #34414