fix(security): escape untrusted scan fields in dashboard history

.jules/sentinel.md

@@ -127,3 +127,10 @@
 **Vulnerability:** The `/api/v1/webhook` POST endpoint in `appguardrail_core/controlplane.py` failed to validate the `url` property when accepting it into the database, leading to Stored SSRF risks. In addition, the core SSRF validation logic (`_is_safe_url`) in both the CLI and control-plane did not verify the input type (e.g. `isinstance(url, str)`). Passing non-string types (like integers) resulted in unhandled `AttributeError` exceptions inside `urllib.parse.urlparse`, which led to API 500 crashes on malicious JSON payloads.
 **Learning:** Network endpoints must explicitly validate the data type of user-provided configurations prior to execution or storage. Furthermore, webhooks configured by users should always be checked for SSRF when saved, as trusting them later assumes input has already been safely validated, bypassing downstream network guardrails.
 **Prevention:** Apply `_is_safe_url` checks directly upon ingestion (e.g., in `/api/v1/webhook`) and enforce type checks `if not isinstance(url, str): return False` prior to using library parsing functions like `urlparse`. Always return gracefully failing responses (like `400 Bad Request`) for unsafe URLs instead of allowing unhandled 500 server errors.
+## 2024-05-18 - DOM XSS via Unescaped Numerical/ID Interpolation
+**Vulnerability:** Found multiple DOM XSS vulnerabilities where variables like counting indexes (`i`), numeric totals (`blocking`), and unique IDs (`id`) were dynamically injected into `innerHTML` using template literals without sanitization.
+**Learning:** Even if the schema expects an integer or a specific pattern, missing a sanitization wrapper (like `esc()`) around any property extracted from an untrusted JSON payload is a DOM XSS vulnerability because an attacker can inject malicious string payloads into those fields.
+**Prevention:** Always use the `esc()` sanitizer for any dynamically rendered property from JSON payloads, including IDs, totals, and loop indices, regardless of their expected data type schema.
+## 2024-05-18 - Internal IDs vs. Dynamically Rendered Properties
+**Learning:** The previous learning about escaping all IDs and numeric values (like indices and lengths) generated by the JavaScript engine natively without coercion was identified as security theater, as they cannot hold XSS payloads.
+**Prevention:** Focus explicitly on IDs and variables provided by the external untrusted JSON payloads rather than loop indices or native JS property lengths.

scanner/dashboard/console.html

@@ -131,7 +131,7 @@ <h1>AppGuardrail Console</h1>
     $("#trend").innerHTML=ord.map(s=>{const h=Math.round(6+((s.deploy_blocking||0)/max)*54);
       const col=(s.deploy_blocking||0)>0?"var(--crit)":"var(--ok)";
       return `<div class="bar" tabindex="0" role="img" aria-label="${esc(s.created_at)}: ${esc(String(s.deploy_blocking||0))} blocking" title="${esc(s.created_at)}: ${esc(String(s.deploy_blocking||0))} blocking" style="height:${h}px;background:${col}"></div>`;}).join("")||'<span class="muted">No scans yet.</span>';
-    $("#history tbody").innerHTML=scans.map(s=>`<tr class="scan" data-id="${s.id}" tabindex="0" role="button" title="View scan details">
+    $("#history tbody").innerHTML=scans.map(s=>`<tr class="scan" data-id="${esc(s.id)}" tabindex="0" role="button" title="View scan details">
       <td>${esc(s.created_at)}</td><td>${esc(s.repo||"—")}</td><td><code>${esc((s.commit||"—").slice(0,10))}</code></td>
       <td>${s.total}</td><td>${pill(s.deploy_blocking,"var(--crit)")}</td><td>${pill(s.new_blocking,"var(--high)")}</td></tr>`).join("")||'<tr><td colspan="6" class="muted">No scans. POST to /api/v1/scans from CI.</td></tr>';
     document.querySelectorAll("tr.scan").forEach(tr=>{