{
  "schemaVersion": 2,
  "repository": "Cacti/cacti",
  "reviewedCommit": "bcb4aaf4ae37ca6bc6b20398f7fdd054505c927c",
  "scope": "All inventoried findings have per-sink source, current core caller and input-contract decisions. Browser coverage checks representative rendering boundaries. Third-party plugin repositories and arbitrary plugin configurations are outside this repository audit; their untrusted values must still be validated/sanitized before entering HTML/selector/URL configuration APIs.",
  "evidence": {
    "browserTests": "tests/e2e/tests/frontend-dependency-security.spec.ts",
    "codeqlBuild": "Managed assets are built before JavaScript extraction so generated libraries remain scanned.",
    "branch": "develop; current 1.2.x does not contain the HTMX integration.",
    "validationMessages": "Cacti formValidate uses the dependency escapeHtml option for title/custom error messages. Browser regression checks initial creation, update, and successful validation; the original setup parses hostile title text as markup in the isolated fixture. No attacker-controlled Cacti title path is established.",
    "browserCases": 23,
    "followUpScope": "Default-branch verification of pending fixes after maintainer merge. No scan exclusions or weakened rules; optional HTML APIs retain an explicit trusted-configuration contract.",
    "branchComparison": "Recorded exact 1.2.x source presence/hashes. The dropdown utility is also present there, with no current core caller found on either branch. This develop PR is API hardening rather than a demonstrated remote vulnerability. The jQuery 4 collection-sort fix targets develop; 1.2.x runtime/CI differs and is not silently backported.",
    "sharedRenderingBoundary": "include/js/cacti-rendering.js exposes one immutable synchronous menuFragment interface for legacy classic-script widgets. It uses minimal tag/attribute allowlists, explicit link protocol checks and text fallback; owned dropdown and navigation-box plugin HTML use it. Labels use text APIs. This does not sanitize unrelated plugin content APIs.",
    "ciRepair": "The certificate display regression derives its expected date from the generated certificate validTo_time_t rather than +30 local-calendar days, which differs across daylight-saving transitions."
  },
  "alerts": [
    {
      "number": 622,
      "rule": "js/xss",
      "path": "include/js/htmx.js",
      "observedState": "open",
      "disposition": "false_positive",
      "evidence": "URL and HTML are distinct history-item fields; serialization loses field-specific taint. Browser save/restore regression.",
      "reportedLine": 1606
    },
    {
      "number": 620,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.validate/jquery.validate.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Current jquery-validation 1.22.1: findByName escapes the attribute selector and returns existing form DOM elements; clean, validationTargetFor and grouped ARIA paths receive those elements, not HTML strings. Browser regression covers hostile field names, all four paths, and preserved ARIA. This conclusion is scoped to the reported selector/element sinks, not message rendering or arbitrary plugin options.",
      "resolution": "Replace ownership/static-rule rationale with DOM-element and escaped-selector evidence; independent message HTML boundary hardened in formValidate with escapeHtml=true.",
      "reportedLine": 631
    },
    {
      "number": 619,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.validate/jquery.validate.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Current jquery-validation 1.22.1: findByName escapes the attribute selector and returns existing form DOM elements; clean, validationTargetFor and grouped ARIA paths receive those elements, not HTML strings. Browser regression covers hostile field names, all four paths, and preserved ARIA. This conclusion is scoped to the reported selector/element sinks, not message rendering or arbitrary plugin options.",
      "resolution": "Replace ownership/static-rule rationale with DOM-element and escaped-selector evidence; independent message HTML boundary hardened in formValidate with escapeHtml=true.",
      "reportedLine": 619
    },
    {
      "number": 169,
      "rule": "js/incomplete-sanitization",
      "path": "include/js/htmx.js",
      "observedState": "dismissed",
      "disposition": "fixed_after_reopening",
      "evidence": "Reopening the obsolete dismissal immediately returned state=fixed; no matching HTMX incomplete-sanitization result exists in current default-branch SARIF.",
      "reportedLine": 1552
    },
    {
      "number": 168,
      "rule": "js/xss",
      "path": "include/js/htmx.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Same history-item URL/content field confusion, with DOMParser as the reported sink.",
      "resolution": "Dismissal replaced with source-specific false-positive rationale and PR/browser evidence.",
      "reportedLine": 532
    },
    {
      "number": 167,
      "rule": "js/incomplete-url-scheme-check",
      "path": "include/js/htmx.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "js:/javascript: prefixes select expression evaluation in hx-vals/hx-vars; this is not a request URL scheme check. Cacti forbids evaluation and browser test verifies rejection.",
      "resolution": "Dismissal replaced with source-specific false-positive rationale and PR/browser evidence.",
      "reportedLine": 3985
    },
    {
      "number": 131,
      "rule": "js/prototype-pollution-utility",
      "path": "include/js/pace.js",
      "observedState": "dismissed",
      "disposition": "fix_pending_merge",
      "evidence": "Pace deep merge can follow prototype keys from option objects. Dependency patch blocks those keys; all three original-code mutation tests fail.",
      "reportedLine": 122
    },
    {
      "number": 130,
      "rule": "js/prototype-pollution-utility",
      "path": "include/js/billboard.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "bindThis is called with library-owned Chart.prototype and copies methods into its Chart instance, rather than merging caller options.",
      "resolution": "Dismissal replaced with source-specific false-positive rationale and PR/browser evidence.",
      "reportedLine": 21507
    },
    {
      "number": 129,
      "rule": "js/prototype-pollution-utility",
      "path": "include/js/billboard.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "mergeObj already rejects __proto__, constructor and prototype; browser test preserves valid data while rejecting prototype keys.",
      "resolution": "Dismissal replaced with source-specific false-positive rationale and PR/browser evidence.",
      "reportedLine": 809
    },
    {
      "number": 126,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 2774,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 2774,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\t\t\tnoResize = ts.getData( $header, tmp, 'resizable' ) === 'false';\n\t\t\t\tif ( !noResize ) {\n\t\t\t\t\t$( '<div class=\"' + ts.css.resizableHandle + '\">' )\n\t\t\t\t\t\t.appendTo( wo.$resizable_container )\n\t\t\t\t\t\t.attr({",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 125,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 2765,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 2765,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\t\tts.resizable.updateStoredSizes( c, wo );\n\n\t\t\two.$resizable_container = $( '<div class=\"' + ts.css.resizableContainer + '\">' )\n\t\t\t\t.css({ top : marginTop })\n\t\t\t\t.insertBefore( $table );",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 124,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 2700,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 2700,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\t\t'.' + ts.css.resizableContainer + ' { position: relative; height: 1px; }' +\n\t\t\t// make handle z-index > than stickyHeader z-index, so the handle stays above sticky header\n\t\t\t'.' + ts.css.resizableHandle + ' { position: absolute; display: inline-block; width: 8px;' +\n\t\t\t\t'top: 1px; cursor: ew-resize; z-index: 3; user-select: none; -moz-user-select: none; }' +\n\t\t\t'</style>';",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 123,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 2698,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 2698,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\t\t'body.' + ts.css.resizableNoSelect + ' { -ms-user-select: none; -moz-user-select: -moz-none;' +\n\t\t\t\t'-khtml-user-select: none; -webkit-user-select: none; user-select: none; }' +\n\t\t\t'.' + ts.css.resizableContainer + ' { position: relative; height: 1px; }' +\n\t\t\t// make handle z-index > than stickyHeader z-index, so the handle stays above sticky header\n\t\t\t'.' + ts.css.resizableHandle + ' { position: absolute; display: inline-block; width: 8px;' +",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 122,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 2696,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 2696,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t$(function() {\n\t\tvar s = '<style>' +\n\t\t\t'body.' + ts.css.resizableNoSelect + ' { -ms-user-select: none; -moz-user-select: -moz-none;' +\n\t\t\t\t'-khtml-user-select: none; -webkit-user-select: none; user-select: none; }' +\n\t\t\t'.' + ts.css.resizableContainer + ' { position: relative; height: 1px; }' +",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 121,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 1122,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 1122,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\t\t\t}\n\t\t\t}\n\t\t\tc.$filters = $( buildFilter += '</tr>' )\n\t\t\t\t.appendTo( c.$table.children( 'thead' ).eq( 0 ) )\n\t\t\t\t.children( 'td' );",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 120,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.timepicker.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Core graph/tree datetimepicker calls use constant format/grid settings; scheduler uses static settings plus a server-generated numeric Date. Field values are date/time parser inputs, not template options. Optional regional labels/select formatting are developer configuration requiring escaped text. Core browser case preserves a valid date/time and rejects markup interpretation of field text.",
      "reportedLine": 1086,
      "inputContract": "Core graph/tree datetimepicker calls use constant format/grid settings; scheduler uses static settings plus a server-generated numeric Date. Field values are date/time parser inputs, not template options. Optional regional labels/select formatting are developer configuration requiring escaped text. Core browser case preserves a valid date/time and rejects markup interpretation of field text.",
      "sourceEvidence": {
        "path": "include/js/jquery.timepicker.js",
        "reportedLine": 1086,
        "builtSha256": "8419cb845f503c624bb78629e27aa44eb7a2f91441b296975cddca51625e185a",
        "reportedSourceExcerpt": "\t\t\t\t\t\tsel += '</option>';\n\t\t\t\t\t}\n\t\t\t\t\tsel += '</select>';\n\n\t\t\t\t\tobj.children('select').remove();",
        "defaultBranchSha256": "8419cb845f503c624bb78629e27aa44eb7a2f91441b296975cddca51625e185a"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 119,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.timepicker.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Core graph/tree datetimepicker calls use constant format/grid settings; scheduler uses static settings plus a server-generated numeric Date. Field values are date/time parser inputs, not template options. Optional regional labels/select formatting are developer configuration requiring escaped text. Core browser case preserves a valid date/time and rejects markup interpretation of field text.",
      "reportedLine": 435,
      "inputContract": "Core graph/tree datetimepicker calls use constant format/grid settings; scheduler uses static settings plus a server-generated numeric Date. Field values are date/time parser inputs, not template options. Optional regional labels/select formatting are developer configuration requiring escaped text. Core browser case preserves a valid date/time and rejects markup interpretation of field text.",
      "sourceEvidence": {
        "path": "include/js/jquery.timepicker.js",
        "reportedLine": 435,
        "builtSha256": "8419cb845f503c624bb78629e27aa44eb7a2f91441b296975cddca51625e185a",
        "reportedSourceExcerpt": "\n\t\t\t\t// Create the elements from string\n\t\t\t\thtml += '</dl></div>';\n\t\t\t\tvar $tp = $(html);\n",
        "defaultBranchSha256": "8419cb845f503c624bb78629e27aa44eb7a2f91441b296975cddca51625e185a"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 118,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 236,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 236,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\t\t\t\tif (!$this.find('.' + ts.css.wrapper).length) {\n\t\t\t\t\t\t// Firefox needs this inner div to position the icon & resizer correctly\n\t\t\t\t\t\t$this.wrapInner('<div class=\"' + ts.css.wrapper + '\" style=\"position:relative;height:100%;width:100%\"></div>');\n\t\t\t\t\t}\n\t\t\t\t});",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 117,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 588,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 588,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\t$elem.html( '<div class=\"' + ts.css.headerIn + '\">' + template + '</div>' ); // faster than wrapInner\n\t\t\t\t}\n\t\t\t\tif ( c.onRenderHeader ) {",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 116,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.js",
      "observedState": "dismissed",
      "disposition": "fixed_after_reopening",
      "evidence": "Scoped reported sink review: Reported selector-scoping values reach querySelectorAll, not HTML parsing. The single-tag branch creates an empty attribute-free element from a tag-name match in an inert parsing document. Browser tests cover escaped context IDs and the single-tag branch. General jQuery HTML-construction APIs remain intentional trusted-HTML APIs, not sanitizers.",
      "reportedLine": 1280,
      "inputContract": "Reported selector-scoping values reach querySelectorAll, not HTML parsing. The single-tag branch creates an empty attribute-free element from a tag-name match in an inert parsing document. Browser tests cover escaped context IDs and the single-tag branch. General jQuery HTML-construction APIs remain intentional trusted-HTML APIs, not sanitizers.",
      "sourceEvidence": {
        "path": "include/js/jquery.js",
        "reportedLine": 1280,
        "builtSha256": "f5fb077959ca06faa1dc50761d8bbb836c6c78067932537a2b3fea9e401257c5",
        "reportedSourceExcerpt": "\t\t\t\t\tnewSelector = groups.join( \",\" );\n\t\t\t\t}\n\n\t\t\t\ttry {\n\t\t\t\t\tpush.apply( results,",
        "defaultBranchSha256": "f5fb077959ca06faa1dc50761d8bbb836c6c78067932537a2b3fea9e401257c5"
      },
      "resolution": "Native alert returned state=fixed upon reopening; no dismissal rewrite was needed. Selector-scoping source/browser evidence remains recorded."
    },
    {
      "number": 115,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.js",
      "observedState": "dismissed",
      "disposition": "fixed_after_reopening",
      "evidence": "Scoped reported sink review: Reported selector-scoping values reach querySelectorAll, not HTML parsing. The single-tag branch creates an empty attribute-free element from a tag-name match in an inert parsing document. Browser tests cover escaped context IDs and the single-tag branch. General jQuery HTML-construction APIs remain intentional trusted-HTML APIs, not sanitizers.",
      "reportedLine": 1279,
      "inputContract": "Reported selector-scoping values reach querySelectorAll, not HTML parsing. The single-tag branch creates an empty attribute-free element from a tag-name match in an inert parsing document. Browser tests cover escaped context IDs and the single-tag branch. General jQuery HTML-construction APIs remain intentional trusted-HTML APIs, not sanitizers.",
      "sourceEvidence": {
        "path": "include/js/jquery.js",
        "reportedLine": 1279,
        "builtSha256": "f5fb077959ca06faa1dc50761d8bbb836c6c78067932537a2b3fea9e401257c5",
        "reportedSourceExcerpt": "\t\t\t\t\t}\n\t\t\t\t\tnewSelector = groups.join( \",\" );\n\t\t\t\t}\n\n\t\t\t\ttry {",
        "defaultBranchSha256": "f5fb077959ca06faa1dc50761d8bbb836c6c78067932537a2b3fea9e401257c5"
      },
      "resolution": "Native alert returned state=fixed upon reopening; no dismissal rewrite was needed. Selector-scoping source/browser evidence remains recorded."
    },
    {
      "number": 114,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.dropdown.js",
      "observedState": "dismissed",
      "disposition": "fix_pending_merge",
      "evidence": "Cacti-owned menu concatenated name/title/subtitle into markup. PR #8298 replaces option-derived structure/labels with DOM/text construction and sanitizes HTML; navigation and fail-closed browser tests pass.",
      "reportedLine": 74,
      "inputContract": "No current core DropDownMenu caller or loader was found. The owned compatibility API now creates structure and labels through DOM/text APIs, validates identifiers and sanitizes supplied menu HTML through one reviewed boundary with explicit protocol checks and plain-text fallback. Browser cases cover formatting, submenu/back navigation, invalid identifiers and sanitizer absence.",
      "sourceEvidence": {
        "path": "include/js/jquery.dropdown.js",
        "reportedLine": 74,
        "builtSha256": "87ba3f9173cec344b5c4b7b491f0b957b55b37f65800ed8a0c8fe2b321f2befb",
        "reportedSourceExcerpt": "\t\t\t+ \"<div id='\" + options.name + \"_content' class='content ui-widget-content ui-state-highlight \" + ((options.subtitle !== false) ? \"\" : \"ui-corner-bottom\" ) + \"'></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_subtitle' class='subtitle ui-state-default ui-corner-bottom'><h6>\" + options.subtitle + \"</h6></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_html' class='html'></div>\"\n\t\t+ \"</div>\").appendTo(\"body\");\n",
        "defaultBranchSha256": "66cc7af07e22c8c34e314d8d9769d298977a74175ce81e61a61a533671292d38"
      },
      "resolution": "Reopen the utility finding; code fix awaits merge/default-branch analysis. No core attacker-controlled call chain was established."
    },
    {
      "number": 113,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.dropdown.js",
      "observedState": "dismissed",
      "disposition": "fix_pending_merge",
      "evidence": "Cacti-owned menu concatenated name/title/subtitle into markup. PR #8298 replaces option-derived structure/labels with DOM/text construction and sanitizes HTML; navigation and fail-closed browser tests pass.",
      "reportedLine": 73,
      "inputContract": "No current core DropDownMenu caller or loader was found. The owned compatibility API now creates structure and labels through DOM/text APIs, validates identifiers and sanitizes supplied menu HTML through one reviewed boundary with explicit protocol checks and plain-text fallback. Browser cases cover formatting, submenu/back navigation, invalid identifiers and sanitizer absence.",
      "sourceEvidence": {
        "path": "include/js/jquery.dropdown.js",
        "reportedLine": 73,
        "builtSha256": "87ba3f9173cec344b5c4b7b491f0b957b55b37f65800ed8a0c8fe2b321f2befb",
        "reportedSourceExcerpt": "\t\t\t+ \"<div id='\" + options.name + \"_back' class='back ui-state-active'></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_content' class='content ui-widget-content ui-state-highlight \" + ((options.subtitle !== false) ? \"\" : \"ui-corner-bottom\" ) + \"'></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_subtitle' class='subtitle ui-state-default ui-corner-bottom'><h6>\" + options.subtitle + \"</h6></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_html' class='html'></div>\"\n\t\t+ \"</div>\").appendTo(\"body\");",
        "defaultBranchSha256": "66cc7af07e22c8c34e314d8d9769d298977a74175ce81e61a61a533671292d38"
      },
      "resolution": "Reopen the utility finding; code fix awaits merge/default-branch analysis. No core attacker-controlled call chain was established."
    },
    {
      "number": 112,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.dropdown.js",
      "observedState": "dismissed",
      "disposition": "fix_pending_merge",
      "evidence": "Cacti-owned menu concatenated name/title/subtitle into markup. PR #8298 replaces option-derived structure/labels with DOM/text construction and sanitizes HTML; navigation and fail-closed browser tests pass.",
      "reportedLine": 73,
      "inputContract": "No current core DropDownMenu caller or loader was found. The owned compatibility API now creates structure and labels through DOM/text APIs, validates identifiers and sanitizes supplied menu HTML through one reviewed boundary with explicit protocol checks and plain-text fallback. Browser cases cover formatting, submenu/back navigation, invalid identifiers and sanitizer absence.",
      "sourceEvidence": {
        "path": "include/js/jquery.dropdown.js",
        "reportedLine": 73,
        "builtSha256": "87ba3f9173cec344b5c4b7b491f0b957b55b37f65800ed8a0c8fe2b321f2befb",
        "reportedSourceExcerpt": "\t\t\t+ \"<div id='\" + options.name + \"_back' class='back ui-state-active'></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_content' class='content ui-widget-content ui-state-highlight \" + ((options.subtitle !== false) ? \"\" : \"ui-corner-bottom\" ) + \"'></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_subtitle' class='subtitle ui-state-default ui-corner-bottom'><h6>\" + options.subtitle + \"</h6></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_html' class='html'></div>\"\n\t\t+ \"</div>\").appendTo(\"body\");",
        "defaultBranchSha256": "66cc7af07e22c8c34e314d8d9769d298977a74175ce81e61a61a533671292d38"
      },
      "resolution": "Reopen the utility finding; code fix awaits merge/default-branch analysis. No core attacker-controlled call chain was established."
    },
    {
      "number": 111,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.dropdown.js",
      "observedState": "dismissed",
      "disposition": "fix_pending_merge",
      "evidence": "Cacti-owned menu concatenated name/title/subtitle into markup. PR #8298 replaces option-derived structure/labels with DOM/text construction and sanitizes HTML; navigation and fail-closed browser tests pass.",
      "reportedLine": 72,
      "inputContract": "No current core DropDownMenu caller or loader was found. The owned compatibility API now creates structure and labels through DOM/text APIs, validates identifiers and sanitizes supplied menu HTML through one reviewed boundary with explicit protocol checks and plain-text fallback. Browser cases cover formatting, submenu/back navigation, invalid identifiers and sanitizer absence.",
      "sourceEvidence": {
        "path": "include/js/jquery.dropdown.js",
        "reportedLine": 72,
        "builtSha256": "87ba3f9173cec344b5c4b7b491f0b957b55b37f65800ed8a0c8fe2b321f2befb",
        "reportedSourceExcerpt": "\t\t\t+ \"<div id='\" + options.name + \"_title' class='title ui-state-default ui-corner-top'><h6>\" + options.title + \"</h6></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_back' class='back ui-state-active'></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_content' class='content ui-widget-content ui-state-highlight \" + ((options.subtitle !== false) ? \"\" : \"ui-corner-bottom\" ) + \"'></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_subtitle' class='subtitle ui-state-default ui-corner-bottom'><h6>\" + options.subtitle + \"</h6></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_html' class='html'></div>\"",
        "defaultBranchSha256": "66cc7af07e22c8c34e314d8d9769d298977a74175ce81e61a61a533671292d38"
      },
      "resolution": "Reopen the utility finding; code fix awaits merge/default-branch analysis. No core attacker-controlled call chain was established."
    },
    {
      "number": 110,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.dropdown.js",
      "observedState": "dismissed",
      "disposition": "fix_pending_merge",
      "evidence": "Cacti-owned menu concatenated name/title/subtitle into markup. PR #8298 replaces option-derived structure/labels with DOM/text construction and sanitizes HTML; navigation and fail-closed browser tests pass.",
      "reportedLine": 71,
      "inputContract": "No current core DropDownMenu caller or loader was found. The owned compatibility API now creates structure and labels through DOM/text APIs, validates identifiers and sanitizes supplied menu HTML through one reviewed boundary with explicit protocol checks and plain-text fallback. Browser cases cover formatting, submenu/back navigation, invalid identifiers and sanitizer absence.",
      "sourceEvidence": {
        "path": "include/js/jquery.dropdown.js",
        "reportedLine": 71,
        "builtSha256": "87ba3f9173cec344b5c4b7b491f0b957b55b37f65800ed8a0c8fe2b321f2befb",
        "reportedSourceExcerpt": "\t\t$(\"<div id='\" + options.name + \"' style='display: none;' class='cacti_dd_menu ui-widget ui-corner-all'>\"\n\t\t\t+ \"<div id='\" + options.name + \"_title' class='title ui-state-default ui-corner-top'><h6>\" + options.title + \"</h6></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_back' class='back ui-state-active'></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_content' class='content ui-widget-content ui-state-highlight \" + ((options.subtitle !== false) ? \"\" : \"ui-corner-bottom\" ) + \"'></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_subtitle' class='subtitle ui-state-default ui-corner-bottom'><h6>\" + options.subtitle + \"</h6></div>\"",
        "defaultBranchSha256": "66cc7af07e22c8c34e314d8d9769d298977a74175ce81e61a61a533671292d38"
      },
      "resolution": "Reopen the utility finding; code fix awaits merge/default-branch analysis. No core attacker-controlled call chain was established."
    },
    {
      "number": 109,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.dropdown.js",
      "observedState": "dismissed",
      "disposition": "fix_pending_merge",
      "evidence": "Cacti-owned menu concatenated name/title/subtitle into markup. PR #8298 replaces option-derived structure/labels with DOM/text construction and sanitizes HTML; navigation and fail-closed browser tests pass.",
      "reportedLine": 70,
      "inputContract": "No current core DropDownMenu caller or loader was found. The owned compatibility API now creates structure and labels through DOM/text APIs, validates identifiers and sanitizes supplied menu HTML through one reviewed boundary with explicit protocol checks and plain-text fallback. Browser cases cover formatting, submenu/back navigation, invalid identifiers and sanitizer absence.",
      "sourceEvidence": {
        "path": "include/js/jquery.dropdown.js",
        "reportedLine": 70,
        "builtSha256": "87ba3f9173cec344b5c4b7b491f0b957b55b37f65800ed8a0c8fe2b321f2befb",
        "reportedSourceExcerpt": "\t\t/* create the main menu structure */\n\t\t$(\"<div id='\" + options.name + \"' style='display: none;' class='cacti_dd_menu ui-widget ui-corner-all'>\"\n\t\t\t+ \"<div id='\" + options.name + \"_title' class='title ui-state-default ui-corner-top'><h6>\" + options.title + \"</h6></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_back' class='back ui-state-active'></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_content' class='content ui-widget-content ui-state-highlight \" + ((options.subtitle !== false) ? \"\" : \"ui-corner-bottom\" ) + \"'></div>\"",
        "defaultBranchSha256": "66cc7af07e22c8c34e314d8d9769d298977a74175ce81e61a61a533671292d38"
      },
      "resolution": "Reopen the utility finding; code fix awaits merge/default-branch analysis. No core attacker-controlled call chain was established."
    },
    {
      "number": 108,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.dropdown.js",
      "observedState": "dismissed",
      "disposition": "fix_pending_merge",
      "evidence": "Cacti-owned menu concatenated name/title/subtitle into markup. PR #8298 replaces option-derived structure/labels with DOM/text construction and sanitizes HTML; navigation and fail-closed browser tests pass.",
      "reportedLine": 70,
      "inputContract": "No current core DropDownMenu caller or loader was found. The owned compatibility API now creates structure and labels through DOM/text APIs, validates identifiers and sanitizes supplied menu HTML through one reviewed boundary with explicit protocol checks and plain-text fallback. Browser cases cover formatting, submenu/back navigation, invalid identifiers and sanitizer absence.",
      "sourceEvidence": {
        "path": "include/js/jquery.dropdown.js",
        "reportedLine": 70,
        "builtSha256": "87ba3f9173cec344b5c4b7b491f0b957b55b37f65800ed8a0c8fe2b321f2befb",
        "reportedSourceExcerpt": "\t\t/* create the main menu structure */\n\t\t$(\"<div id='\" + options.name + \"' style='display: none;' class='cacti_dd_menu ui-widget ui-corner-all'>\"\n\t\t\t+ \"<div id='\" + options.name + \"_title' class='title ui-state-default ui-corner-top'><h6>\" + options.title + \"</h6></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_back' class='back ui-state-active'></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_content' class='content ui-widget-content ui-state-highlight \" + ((options.subtitle !== false) ? \"\" : \"ui-corner-bottom\" ) + \"'></div>\"",
        "defaultBranchSha256": "66cc7af07e22c8c34e314d8d9769d298977a74175ce81e61a61a533671292d38"
      },
      "resolution": "Reopen the utility finding; code fix awaits merge/default-branch analysis. No core attacker-controlled call chain was established."
    },
    {
      "number": 107,
      "rule": "js/html-constructed-from-input",
      "path": "include/js/jquery.dropdown.js",
      "observedState": "dismissed",
      "disposition": "fix_pending_merge",
      "evidence": "Cacti-owned menu concatenated name/title/subtitle into markup. PR #8298 replaces option-derived structure/labels with DOM/text construction and sanitizes HTML; navigation and fail-closed browser tests pass.",
      "reportedLine": 69,
      "inputContract": "No current core DropDownMenu caller or loader was found. The owned compatibility API now creates structure and labels through DOM/text APIs, validates identifiers and sanitizes supplied menu HTML through one reviewed boundary with explicit protocol checks and plain-text fallback. Browser cases cover formatting, submenu/back navigation, invalid identifiers and sanitizer absence.",
      "sourceEvidence": {
        "path": "include/js/jquery.dropdown.js",
        "reportedLine": 69,
        "builtSha256": "87ba3f9173cec344b5c4b7b491f0b957b55b37f65800ed8a0c8fe2b321f2befb",
        "reportedSourceExcerpt": "\tfunction _init_menu(initiator){\n\t\t/* create the main menu structure */\n\t\t$(\"<div id='\" + options.name + \"' style='display: none;' class='cacti_dd_menu ui-widget ui-corner-all'>\"\n\t\t\t+ \"<div id='\" + options.name + \"_title' class='title ui-state-default ui-corner-top'><h6>\" + options.title + \"</h6></div>\"\n\t\t\t+ \"<div id='\" + options.name + \"_back' class='back ui-state-active'></div>\"",
        "defaultBranchSha256": "66cc7af07e22c8c34e314d8d9769d298977a74175ce81e61a61a533671292d38"
      },
      "resolution": "Reopen the utility finding; code fix awaits merge/default-branch analysis. No core attacker-controlled call chain was established."
    },
    {
      "number": 106,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jstree.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Core get_node callers use context-menu data.reference DOM elements, or existing node IDs; get_node does not consume label text. vakata.attributes is used internally on existing DOM nodes, with no core direct caller. Server tree labels are htmle-escaped and the editor sets force_text=true. Public selector/node APIs do not promise to sanitize arbitrary HTML supplied by plugin code.",
      "reportedLine": 4951,
      "inputContract": "Core get_node callers use context-menu data.reference DOM elements, or existing node IDs; get_node does not consume label text. vakata.attributes is used internally on existing DOM nodes, with no core direct caller. Server tree labels are htmle-escaped and the editor sets force_text=true. Public selector/node APIs do not promise to sanitize arbitrary HTML supplied by plugin code.",
      "sourceEvidence": {
        "path": "include/js/jstree.js",
        "reportedLine": 4951,
        "builtSha256": "edd6e2947f02b3e7e9320cbc6b7ce5763aeb503373fcb7f90f684db1661d6c3b",
        "reportedSourceExcerpt": "\t// collect attributes\n\t$.vakata.attributes = function(node, with_values) {\n\t\tnode = $(node)[0];\n\t\tvar attr = with_values ? {} : [];\n\t\tif(node && node.attributes) {",
        "defaultBranchSha256": "edd6e2947f02b3e7e9320cbc6b7ce5763aeb503373fcb7f90f684db1661d6c3b"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 105,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jstree.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "jsTree edit() keeps h2 as the internally constructed rename-input jQuery object; the outside-click handler wraps that same object and triggers blur. Cacti ctree already enables core.force_text=true. Browser coverage reads that actual configuration and verifies markup-like rename text survives outside-click blur without becoming HTML. Scoped to this reported h2 sink and current Cacti editor, not arbitrary plugin rendering.",
      "resolution": "Replace ownership-only dismissal with controlled rename-input evidence and existing force_text/browser coverage in PR #8298.",
      "reportedLine": 4657
    },
    {
      "number": 104,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jstree.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "jsTree get_next_dom/get_prev_dom obtain next/previous siblings through DOM traversal; the reported jQuery constructors wrap DOM elements, not node label HTML. Browser test verifies element identity for strict and ordinary forward/backward paths with markup-like labels.",
      "resolution": "Replace ownership-only dismissal with sibling DOM evidence and browser coverage in PR #8298.",
      "reportedLine": 1180
    },
    {
      "number": 103,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jstree.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "jsTree get_next_dom/get_prev_dom obtain next/previous siblings through DOM traversal; the reported jQuery constructors wrap DOM elements, not node label HTML. Browser test verifies element identity for strict and ordinary forward/backward paths with markup-like labels.",
      "resolution": "Replace ownership-only dismissal with sibling DOM evidence and browser coverage in PR #8298.",
      "reportedLine": 1173
    },
    {
      "number": 102,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jstree.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "jsTree get_next_dom/get_prev_dom obtain next/previous siblings through DOM traversal; the reported jQuery constructors wrap DOM elements, not node label HTML. Browser test verifies element identity for strict and ordinary forward/backward paths with markup-like labels.",
      "resolution": "Replace ownership-only dismissal with sibling DOM evidence and browser coverage in PR #8298.",
      "reportedLine": 1144
    },
    {
      "number": 101,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jstree.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "jsTree get_next_dom/get_prev_dom obtain next/previous siblings through DOM traversal; the reported jQuery constructors wrap DOM elements, not node label HTML. Browser test verifies element identity for strict and ordinary forward/backward paths with markup-like labels.",
      "resolution": "Replace ownership-only dismissal with sibling DOM evidence and browser coverage in PR #8298.",
      "reportedLine": 1128
    },
    {
      "number": 100,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jstree.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Core get_node callers use context-menu data.reference DOM elements, or existing node IDs; get_node does not consume label text. vakata.attributes is used internally on existing DOM nodes, with no core direct caller. Server tree labels are htmle-escaped and the editor sets force_text=true. Public selector/node APIs do not promise to sanitize arbitrary HTML supplied by plugin code.",
      "reportedLine": 171,
      "inputContract": "Core get_node callers use context-menu data.reference DOM elements, or existing node IDs; get_node does not consume label text. vakata.attributes is used internally on existing DOM nodes, with no core direct caller. Server tree labels are htmle-escaped and the editor sets force_text=true. Public selector/node APIs do not promise to sanitize arbitrary HTML supplied by plugin code.",
      "sourceEvidence": {
        "path": "include/js/jstree.js",
        "reportedLine": 171,
        "builtSha256": "edd6e2947f02b3e7e9320cbc6b7ce5763aeb503373fcb7f90f684db1661d6c3b",
        "reportedSourceExcerpt": "\n\t\tif(!obj || !obj.length) {\n\t\t\ttry { obj = $(needle); } catch (ignore) { }\n\t\t}\n\t\tif(!obj || !obj.length) {",
        "defaultBranchSha256": "edd6e2947f02b3e7e9320cbc6b7ce5763aeb503373fcb7f90f684db1661d6c3b"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 99,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/vendor/daterangepicker/daterangepicker.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "reportedLine": 295,
      "inputContract": "No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "sourceEvidence": {
        "path": "include/js/vendor/daterangepicker/daterangepicker.js",
        "reportedLine": 295,
        "builtSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4",
        "reportedSourceExcerpt": "        if (typeof options.startDate === 'undefined' && typeof options.endDate === 'undefined') {\n            if ($(this.element).is(':text')) {\n                var val = $(this.element).val(),\n                    split = val.split(this.locale.separator);\n",
        "defaultBranchSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 98,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/vendor/daterangepicker/daterangepicker.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "reportedLine": 294,
      "inputContract": "No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "sourceEvidence": {
        "path": "include/js/vendor/daterangepicker/daterangepicker.js",
        "reportedLine": 294,
        "builtSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4",
        "reportedSourceExcerpt": "        //if no start/end dates set, check if an input element contains initial values\n        if (typeof options.startDate === 'undefined' && typeof options.endDate === 'undefined') {\n            if ($(this.element).is(':text')) {\n                var val = $(this.element).val(),\n                    split = val.split(this.locale.separator);",
        "defaultBranchSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 97,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/vendor/daterangepicker/daterangepicker.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "reportedLine": 120,
      "inputContract": "No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "sourceEvidence": {
        "path": "include/js/vendor/daterangepicker/daterangepicker.js",
        "reportedLine": 120,
        "builtSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4",
        "reportedSourceExcerpt": "\n        this.parentEl = (options.parentEl && $(options.parentEl).length) ? $(options.parentEl) : $(this.parentEl);\n        this.container = $(options.template).appendTo(this.parentEl);\n\n        //",
        "defaultBranchSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 96,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/vendor/daterangepicker/daterangepicker.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "reportedLine": 119,
      "inputContract": "No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "sourceEvidence": {
        "path": "include/js/vendor/daterangepicker/daterangepicker.js",
        "reportedLine": 119,
        "builtSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4",
        "reportedSourceExcerpt": "            '</div>';\n\n        this.parentEl = (options.parentEl && $(options.parentEl).length) ? $(options.parentEl) : $(this.parentEl);\n        this.container = $(options.template).appendTo(this.parentEl);\n",
        "defaultBranchSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 95,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/vendor/daterangepicker/daterangepicker.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "reportedLine": 119,
      "inputContract": "No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "sourceEvidence": {
        "path": "include/js/vendor/daterangepicker/daterangepicker.js",
        "reportedLine": 119,
        "builtSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4",
        "reportedSourceExcerpt": "            '</div>';\n\n        this.parentEl = (options.parentEl && $(options.parentEl).length) ? $(options.parentEl) : $(this.parentEl);\n        this.container = $(options.template).appendTo(this.parentEl);\n",
        "defaultBranchSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 94,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/vendor/daterangepicker/daterangepicker.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "reportedLine": 119,
      "inputContract": "No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "sourceEvidence": {
        "path": "include/js/vendor/daterangepicker/daterangepicker.js",
        "reportedLine": 119,
        "builtSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4",
        "reportedSourceExcerpt": "            '</div>';\n\n        this.parentEl = (options.parentEl && $(options.parentEl).length) ? $(options.parentEl) : $(this.parentEl);\n        this.container = $(options.template).appendTo(this.parentEl);\n",
        "defaultBranchSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 93,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/vendor/daterangepicker/daterangepicker.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "reportedLine": 36,
      "inputContract": "No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "sourceEvidence": {
        "path": "include/js/vendor/daterangepicker/daterangepicker.js",
        "reportedLine": 36,
        "builtSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4",
        "reportedSourceExcerpt": "        //default settings for options\n        this.parentEl = 'body';\n        this.element = $(element);\n        this.startDate = moment().startOf('day');\n        this.endDate = moment().endOf('day');",
        "defaultBranchSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 92,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.validate/jquery.validate.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Current jquery-validation 1.22.1: findByName escapes the attribute selector and returns existing form DOM elements; clean, validationTargetFor and grouped ARIA paths receive those elements, not HTML strings. Browser regression covers hostile field names, all four paths, and preserved ARIA. This conclusion is scoped to the reported selector/element sinks, not message rendering or arbitrary plugin options.",
      "resolution": "Replace ownership/static-rule rationale with DOM-element and escaped-selector evidence; independent message HTML boundary hardened in formValidate with escapeHtml=true.",
      "reportedLine": 1160
    },
    {
      "number": 91,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.validate/jquery.validate.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Current jquery-validation 1.22.1: findByName escapes the attribute selector and returns existing form DOM elements; clean, validationTargetFor and grouped ARIA paths receive those elements, not HTML strings. Browser regression covers hostile field names, all four paths, and preserved ARIA. This conclusion is scoped to the reported selector/element sinks, not message rendering or arbitrary plugin options.",
      "resolution": "Replace ownership/static-rule rationale with DOM-element and escaped-selector evidence; independent message HTML boundary hardened in formValidate with escapeHtml=true.",
      "reportedLine": 772
    },
    {
      "number": 90,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 2337,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 2337,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\n\tts.setFilters = function( table, filter, apply, skipFirst ) {\n\t\tvar c = table ? $( table )[0].config : '',\n\t\t\tvalid = ts.getFilters( table, true, filter, skipFirst );\n\t\t// default apply to \"true\"",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 89,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 2274,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 2274,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\t\t( Array.isArray(setFilters) && tsf.equalFilters(c, setFilters, c.lastSearch) )\n\t\t) {\n\t\t\treturn $( table ).data( 'lastSearch' ) || [];\n\t\t}\n\t\tif ( c ) {",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 88,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 2267,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 2267,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\tvar i, $filters, $column, cols,\n\t\t\tfilters = [],\n\t\t\tc = table ? $( table )[0].config : '',\n\t\t\two = c ? c.widgetOptions : '';\n\t\tif ( ( getRaw !== true && wo && !wo.filter_columnFilters ) ||",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 87,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 2094,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 2094,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\t},\n\t\tgetOptions: function( table, column, onlyAvail ) {\n\t\t\ttable = $( table )[0];\n\t\t\tvar rowIndex, tbodyIndex, len, row, cache, indx, child, childLen,\n\t\t\t\tc = table.config,",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 86,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 2024,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 2024,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\t\t\treturn false;\n\t\t\t}\n\t\t\ttable = $( table )[0];\n\t\t\tvar cts, txt, indx, len, parsedTxt, str,\n\t\t\t\tc = table.config,",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 85,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 1983,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 1983,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\t},\n\t\tgetOptionSource: function( table, column, onlyAvail ) {\n\t\t\ttable = $( table )[0];\n\t\t\tvar c = table.config,\n\t\t\t\two = c.widgetOptions,",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 84,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 1460,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 1460,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\t\tif ( $input ) {\n\t\t\t\treturn $input.sort( function( a, b ) {\n\t\t\t\t\treturn $( b ).attr( 'data-lastSearchTime' ) - $( a ).attr( 'data-lastSearchTime' );\n\t\t\t\t});\n\t\t\t}",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 83,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 1460,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 1460,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\t\tif ( $input ) {\n\t\t\t\treturn $input.sort( function( a, b ) {\n\t\t\t\t\treturn $( b ).attr( 'data-lastSearchTime' ) - $( a ).attr( 'data-lastSearchTime' );\n\t\t\t\t});\n\t\t\t}",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 82,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 57,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 57,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\t\tsession = storageType ? '' :\n\t\t\t\t( options && options.useSessionStorage ) || ( wo && wo.storage_useSessionStorage ),\n\t\t\t$table = $(table),\n\t\t\t// id from (1) options ID, (2) table 'data-table-group' attribute, (3) widgetOptions.storage_tableId,\n\t\t\t// (4) table ID, then (5) table index",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 81,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 44,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 44,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t*/\n\tts.storage = function(table, key, value, options) {\n\t\ttable = $(table)[0];\n\t\tvar cookieIndex, cookies, date,\n\t\t\thasStorage = false,",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 80,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 2478,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 2478,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\t\t\t}\n\t\t\tvar holdr = $( table ).find( 'colgroup.tablesorter-savemyplace' );\n\t\t\t$tb.insertAfter( holdr );\n\t\t\tholdr.remove();\n\t\t\ttable.isProcessing = false;",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 79,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 2477,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 2477,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\t\t\t\treturn $.fn.detach ? $tb.detach() : $tb.remove();\n\t\t\t}\n\t\t\tvar holdr = $( table ).find( 'colgroup.tablesorter-savemyplace' );\n\t\t\t$tb.insertAfter( holdr );\n\t\t\tholdr.remove();",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 78,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 2471,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 2471,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\t\t// don't use tbody because there are portions that look for a tbody index (updateCell)\n\t\tprocessTbody : function( table, $tb, getIt ) {\n\t\t\ttable = $( table )[ 0 ];\n\t\t\tif ( getIt ) {\n\t\t\t\ttable.isProcessing = true;",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 77,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 2447,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 2447,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\t\t// add processing indicator\n\t\tisProcessing : function( $table, toggle, $headers ) {\n\t\t\t$table = $( $table );\n\t\t\tvar c = $table[ 0 ].config,\n\t\t\t\t// default to all headers",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 76,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 2419,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 2419,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\t\t\t\treturn obj;\n\t\t\t}\n\t\t\ttable = $( table )[ 0 ];\n\t\t\tvar $header, key,\n\t\t\t\tc = table.config,",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 75,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 2395,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 2395,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\t\t\tvar meta, cl4ss,\n\t\t\t\tval = '',\n\t\t\t\t$header = $( header );\n\t\t\tif ( !$header.length ) { return ''; }\n\t\t\tmeta = $.metadata ? $header.metadata() : false;",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 74,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 2189,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 2189,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\t\t\t\tlist = [],\n\t\t\t\tcallback = function( table ) {\n\t\t\t\t\t$( table ).triggerHandler( 'refreshComplete' );\n\t\t\t\t};\n\t\t\t// remove widgets not defined in config.widgets, unless doAll is true",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 73,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 2143,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 2143,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\n\t\tremoveWidget : function( table, name, refreshing ) {\n\t\t\ttable = $( table )[ 0 ];\n\t\t\tvar index, widget, indx, len,\n\t\t\t\tc = table.config;",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 72,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 2076,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 2076,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\n\t\tapplyWidget : function( table, init, callback ) {\n\t\t\ttable = $( table )[ 0 ]; // in case this is called externally\n\t\t\tvar indx, len, names, widget, time,\n\t\t\t\tc = table.config,",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 71,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 2029,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 2029,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\n\t\tapplyWidgetId : function( table, id, init ) {\n\t\t\ttable = $(table)[0];\n\t\t\tvar applied, time, name,\n\t\t\t\tc = table.config,",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 70,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 1560,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 1560,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\t\t\t\ttable = c.table,\n\t\t\t\tlen = c.$headers.length,\n\t\t\t\tth = ts.getClosest( $( cell ), 'th, td' ),\n\t\t\t\tcol = parseInt( th.attr( 'data-column' ), 10 ),\n\t\t\t\tsortedBy = event.type === 'mouseup' ? 'user' : event.type,",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 69,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 1110,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 1110,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\t\t\t\t\t.find( 'tfoot tr' )\n\t\t\t\t\t.children( 'td, th' )\n\t\t\t\t\t.add( $( c.namespace + '_extra_headers' ) )\n\t\t\t\t\t.removeClass( css.join( ' ' ) ),\n\t\t\t\t// remove all header information",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 68,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 966,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 966,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\t\t\t\t\t\t\tif ( !hasParser && debug ) {\n\t\t\t\t\t\t\t\tconsole.warn( 'No parser found for row: ' + rowIndex + ', column: ' + colIndex +\n\t\t\t\t\t\t\t\t\t'; cell containing: \"' + $(cell).text() + '\"; does it have a header?' );\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tval = ts.getElementText( c, cell, cacheIndex );",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 67,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 828,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 828,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\t\t\t\t// node could be a jquery object\n\t\t\t\t// http://jsperf.com/jquery-vs-instanceof-jquery/2\n\t\t\t\t$node = node.jquery ? node : $( node );\n\t\t\tif ( typeof extract === 'string' ) {\n\t\t\t\t// check data-attribute first when set to 'basic'; don't use node.innerText - it's really slow!",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 66,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 563,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 563,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\t\t\tc.$headers = $( $.map( c.$table.find( c.selectorHeaders ), function( elem, index ) {\n\t\t\t\tvar configHeaders, header, column, template, tmp,\n\t\t\t\t\t$elem = $( elem );\n\t\t\t\t// ignore cell (don't add it to c.$headers) if row has ignoreRow class\n\t\t\t\tif ( ts.getClosest( $elem, 'tr' ).hasClass( c.cssIgnoreRow ) ) { return; }",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 65,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablesorter.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "reportedLine": 472,
      "inputContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.js",
        "reportedLine": 472,
        "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
        "reportedSourceExcerpt": "\t\t\t\ttmp = ts.getClosest( $headers, 'table' );\n\t\t\t\tif ( tmp.length && tmp[ 0 ].nodeName === 'TABLE' && tmp[ 0 ] !== table ) {\n\t\t\t\t\t$( tmp[ 0 ] ).addClass( namespace.slice( 1 ) + '_extra_table' );\n\t\t\t\t}\n\t\t\t}",
        "defaultBranchSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 64,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.tablednd.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "tableDnD makeDraggable uses table.rows (HTMLCollection), iterates row DOM elements, and calls $(this).css with static cursor strings. Row content is never passed to the jQuery constructor at this sink. Browser regression verifies preserved row identity, hostile text retained as text, and nodrag behavior.",
      "resolution": "Replace library-ownership dismissal with DOM-element source evidence and browser regression in PR #8298.",
      "reportedLine": 183
    },
    {
      "number": 63,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 18024,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 18024,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\tvar options = this.options,\n\t\t\tactive = this.active,\n\t\t\tanchor = $( event.currentTarget ),\n\t\t\ttab = anchor.closest( \"li\" ),\n\t\t\tclickedIsActive = tab[ 0 ] === active[ 0 ],",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 62,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 16551,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 16551,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\t\tco.top + ( over ? Math.max( ce.scrollHeight, ce.offsetHeight ) : ce.offsetHeight ) -\n\t\t\t\t\t( parseInt( $( ce ).css( \"borderTopWidth\" ), 10 ) || 0 ) -\n\t\t\t\t\t( parseInt( $( ce ).css( \"paddingBottom\" ), 10 ) || 0 ) -\n\t\t\t\t\tthis.helperProportions.height - this.margins.top\n\t\t\t];",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 61,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 16550,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 16550,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\t\t\tthis.helperProportions.width - this.margins.left,\n\t\t\t\tco.top + ( over ? Math.max( ce.scrollHeight, ce.offsetHeight ) : ce.offsetHeight ) -\n\t\t\t\t\t( parseInt( $( ce ).css( \"borderTopWidth\" ), 10 ) || 0 ) -\n\t\t\t\t\t( parseInt( $( ce ).css( \"paddingBottom\" ), 10 ) || 0 ) -\n\t\t\t\t\tthis.helperProportions.height - this.margins.top",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 60,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 16547,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 16547,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\t\tco.left + ( over ? Math.max( ce.scrollWidth, ce.offsetWidth ) : ce.offsetWidth ) -\n\t\t\t\t\t( parseInt( $( ce ).css( \"borderLeftWidth\" ), 10 ) || 0 ) -\n\t\t\t\t\t( parseInt( $( ce ).css( \"paddingRight\" ), 10 ) || 0 ) -\n\t\t\t\t\tthis.helperProportions.width - this.margins.left,\n\t\t\t\tco.top + ( over ? Math.max( ce.scrollHeight, ce.offsetHeight ) : ce.offsetHeight ) -",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 59,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 16546,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 16546,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\t\t\t( parseInt( $( ce ).css( \"paddingTop\" ), 10 ) || 0 ) - this.margins.top,\n\t\t\t\tco.left + ( over ? Math.max( ce.scrollWidth, ce.offsetWidth ) : ce.offsetWidth ) -\n\t\t\t\t\t( parseInt( $( ce ).css( \"borderLeftWidth\" ), 10 ) || 0 ) -\n\t\t\t\t\t( parseInt( $( ce ).css( \"paddingRight\" ), 10 ) || 0 ) -\n\t\t\t\t\tthis.helperProportions.width - this.margins.left,",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 58,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 16544,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 16544,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\t\t\t( parseInt( $( ce ).css( \"paddingLeft\" ), 10 ) || 0 ) - this.margins.left,\n\t\t\t\tco.top + ( parseInt( $( ce ).css( \"borderTopWidth\" ), 10 ) || 0 ) +\n\t\t\t\t\t( parseInt( $( ce ).css( \"paddingTop\" ), 10 ) || 0 ) - this.margins.top,\n\t\t\t\tco.left + ( over ? Math.max( ce.scrollWidth, ce.offsetWidth ) : ce.offsetWidth ) -\n\t\t\t\t\t( parseInt( $( ce ).css( \"borderLeftWidth\" ), 10 ) || 0 ) -",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 57,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 16543,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 16543,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\t\tco.left + ( parseInt( $( ce ).css( \"borderLeftWidth\" ), 10 ) || 0 ) +\n\t\t\t\t\t( parseInt( $( ce ).css( \"paddingLeft\" ), 10 ) || 0 ) - this.margins.left,\n\t\t\t\tco.top + ( parseInt( $( ce ).css( \"borderTopWidth\" ), 10 ) || 0 ) +\n\t\t\t\t\t( parseInt( $( ce ).css( \"paddingTop\" ), 10 ) || 0 ) - this.margins.top,\n\t\t\t\tco.left + ( over ? Math.max( ce.scrollWidth, ce.offsetWidth ) : ce.offsetWidth ) -",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 56,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 16542,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 16542,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\tthis.containment = [\n\t\t\t\tco.left + ( parseInt( $( ce ).css( \"borderLeftWidth\" ), 10 ) || 0 ) +\n\t\t\t\t\t( parseInt( $( ce ).css( \"paddingLeft\" ), 10 ) || 0 ) - this.margins.left,\n\t\t\t\tco.top + ( parseInt( $( ce ).css( \"borderTopWidth\" ), 10 ) || 0 ) +\n\t\t\t\t\t( parseInt( $( ce ).css( \"paddingTop\" ), 10 ) || 0 ) - this.margins.top,",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 55,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 16541,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 16541,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\n\t\t\tthis.containment = [\n\t\t\t\tco.left + ( parseInt( $( ce ).css( \"borderLeftWidth\" ), 10 ) || 0 ) +\n\t\t\t\t\t( parseInt( $( ce ).css( \"paddingLeft\" ), 10 ) || 0 ) - this.margins.left,\n\t\t\t\tco.top + ( parseInt( $( ce ).css( \"borderTopWidth\" ), 10 ) || 0 ) +",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 54,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 16538,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 16538,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\tce = $( o.containment )[ 0 ];\n\t\t\tco = $( o.containment ).offset();\n\t\t\tover = ( $( ce ).css( \"overflow\" ) !== \"hidden\" );\n\n\t\t\tthis.containment = [",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 53,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 16271,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 16271,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\t$( \"<td>&#160;</td>\", that.document[ 0 ] )\n\t\t\t\t.attr( \"colspan\", $( this ).attr( \"colspan\" ) || 1 )\n\t\t\t\t.appendTo( targetTr );\n\t\t} );\n\t},",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 52,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 16206,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 16206,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\t\t\t\tthat._createTrPlaceholder(\n\t\t\t\t\t\t\tthat.currentItem.find( \"tr\" ).eq( 0 ),\n\t\t\t\t\t\t\t$( \"<tr>\", that.document[ 0 ] ).appendTo( element )\n\t\t\t\t\t\t);\n\t\t\t\t\t} else if ( nodeName === \"tr\" ) {",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 51,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 16109,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 16109,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\n\t\t\tfor ( j = 0, queriesLength = _queries.length; j < queriesLength; j++ ) {\n\t\t\t\titem = $( _queries[ j ] );\n\n\t\t\t\t// Data for target checking (mouse manager)",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 50,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 15885,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 15885,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\to = o || {};\n\n\t\t$( items ).each( function() {\n\t\t\tvar res = ( $( o.item || this ).attr( o.attribute || \"id\" ) || \"\" )\n\t\t\t\t.match( o.expression || ( /(.+)[\\-=_](.+)/ ) );",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 49,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 15611,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 15611,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t//Move the helper, if needed\n\t\tif ( !this.helper.parent().is( this.appendTo ) ) {\n\t\t\tthis.helper.detach().appendTo( this.appendTo );\n\n\t\t\t//Update position",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 48,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.contextMenu.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: No exact core contextMenu initializer was found. Access-key labels use text/createTextNode. Normalized context objects are DOM elements; generic context accepts a developer selector/DOM contract. isHtmlName explicitly opts into trusted HTML and must not receive raw plugin/database output. This generic API contract is not a remotely reachable Cacti defect.",
      "reportedLine": 1803,
      "inputContract": "Midwinter navigationBox.js initializes contextMenu at its build boundary. Built-in and bundled tree/table-layout menu names are static text; the context uses the library default document and its selector is generated from box configuration. Access-key names use text/createTextNode, and normalized contexts are DOM nodes. This PR forces plugin menu labels to text and routes explicit HTML items through the shared CactiRenderer.menuFragment boundary with a plain-text fallback. Generic context/selector/HTML APIs still require developer-controlled targets and sanitized input.",
      "sourceEvidence": {
        "path": "include/js/jquery.contextMenu.js",
        "reportedLine": 1803,
        "builtSha256": "37bde1fa1ccc2e9233c9749193fb87be93e81c98f855b139a0938c6b633acb30",
        "reportedSourceExcerpt": "\n                        // Is this menu equest to the context called from\n                        if (!$(context).is(o.selector)) {\n                            return true;\n                        }",
        "defaultBranchSha256": "37bde1fa1ccc2e9233c9749193fb87be93e81c98f855b139a0938c6b633acb30"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 47,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 12923,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 12923,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\n\t\tthis.overlay = $( \"<div>\" )\n\t\t\t.appendTo( this._appendTo() );\n\n\t\tthis._addClass( this.overlay, null, \"ui-widget-overlay ui-front\" );",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 46,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.contextMenu.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: No exact core contextMenu initializer was found. Access-key labels use text/createTextNode. Normalized context objects are DOM elements; generic context accepts a developer selector/DOM contract. isHtmlName explicitly opts into trusted HTML and must not receive raw plugin/database output. This generic API contract is not a remotely reachable Cacti defect.",
      "reportedLine": 1681,
      "inputContract": "Midwinter navigationBox.js initializes contextMenu at its build boundary. Built-in and bundled tree/table-layout menu names are static text; the context uses the library default document and its selector is generated from box configuration. Access-key names use text/createTextNode, and normalized contexts are DOM nodes. This PR forces plugin menu labels to text and routes explicit HTML items through the shared CactiRenderer.menuFragment boundary with a plain-text fallback. Generic context/selector/HTML APIs still require developer-controlled targets and sanitized input.",
      "sourceEvidence": {
        "path": "include/js/jquery.contextMenu.js",
        "reportedLine": 1681,
        "builtSha256": "37bde1fa1ccc2e9233c9749193fb87be93e81c98f855b139a0938c6b633acb30",
        "reportedSourceExcerpt": "            $context = $(o.context).first();\n            o.context = $context.get(0);\n            _hasContext = !$(o.context).is(document);\n        }\n",
        "defaultBranchSha256": "37bde1fa1ccc2e9233c9749193fb87be93e81c98f855b139a0938c6b633acb30"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 45,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.contextMenu.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Midwinter navigationBox.js initializes contextMenu at its build boundary. Built-in and bundled tree/table-layout menu names are static text; the context uses the library default document and its selector is generated from box configuration. Access-key names use text/createTextNode, and normalized contexts are DOM nodes. This PR forces plugin menu labels to text and routes explicit HTML items through the shared CactiRenderer.menuFragment boundary with a plain-text fallback. Generic context/selector/HTML APIs still require developer-controlled targets and sanitized input.",
      "reportedLine": 1679,
      "inputContract": "Midwinter navigationBox.js initializes contextMenu at its build boundary. Built-in and bundled tree/table-layout menu names are static text; the context uses the library default document and its selector is generated from box configuration. Access-key names use text/createTextNode, and normalized contexts are DOM nodes. This PR forces plugin menu labels to text and routes explicit HTML items through the shared CactiRenderer.menuFragment boundary with a plain-text fallback. Generic context/selector/HTML APIs still require developer-controlled targets and sanitized input.",
      "sourceEvidence": {
        "path": "include/js/jquery.contextMenu.js",
        "reportedLine": 1679,
        "builtSha256": "37bde1fa1ccc2e9233c9749193fb87be93e81c98f855b139a0938c6b633acb30",
        "reportedSourceExcerpt": "        } else {\n            // you never know what they throw at you...\n            $context = $(o.context).first();\n            o.context = $context.get(0);\n            _hasContext = !$(o.context).is(document);",
        "defaultBranchSha256": "37bde1fa1ccc2e9233c9749193fb87be93e81c98f855b139a0938c6b633acb30"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 44,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 12507,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 12507,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\n\t\tthis.uiButtonSet = $( \"<div>\" )\n\t\t\t.appendTo( this.uiDialogButtonPane );\n\t\tthis._addClass( this.uiButtonSet, \"ui-dialog-buttonset\" );\n",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 43,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 12482,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 12482,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\n\t\tuiDialogTitle = $( \"<\" + uiDialogHeadingLevel + \">\" )\n\t\t\t.uniqueId().prependTo( this.uiDialogTitlebar );\n\t\tthis._addClass( uiDialogTitle, \"ui-dialog-title\" );\n\t\tthis._title( uiDialogTitle );",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 42,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 12466,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 12466,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\t\tshowLabel: false\n\t\t\t} )\n\t\t\t.appendTo( this.uiDialogTitlebar );\n\n\t\tthis._addClass( this.uiDialogTitlebarClose, \"ui-dialog-titlebar-close\" );",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 41,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 12389,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 12389,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\t\t\"aria-modal\": this.options.modal ? \"true\" : null\n\t\t\t} )\n\t\t\t.appendTo( this._appendTo() );\n\n\t\tthis._addClass( this.uiDialog, \"ui-dialog\", \"ui-widget ui-widget-content ui-front\" );",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 40,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.contextMenu.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: No exact core contextMenu initializer was found. Access-key labels use text/createTextNode. Normalized context objects are DOM elements; generic context accepts a developer selector/DOM contract. isHtmlName explicitly opts into trusted HTML and must not receive raw plugin/database output. This generic API contract is not a remotely reachable Cacti defect.",
      "reportedLine": 1150,
      "inputContract": "Midwinter navigationBox.js initializes contextMenu at its build boundary. Built-in and bundled tree/table-layout menu names are static text; the context uses the library default document and its selector is generated from box configuration. Access-key names use text/createTextNode, and normalized contexts are DOM nodes. This PR forces plugin menu labels to text and routes explicit HTML items through the shared CactiRenderer.menuFragment boundary with a plain-text fallback. Generic context/selector/HTML APIs still require developer-controlled targets and sanitized input.",
      "sourceEvidence": {
        "path": "include/js/jquery.contextMenu.js",
        "reportedLine": 1150,
        "builtSha256": "37bde1fa1ccc2e9233c9749193fb87be93e81c98f855b139a0938c6b633acb30",
        "reportedSourceExcerpt": "                            .addClass('context-menu-accesskey')\n                            .text(item._accesskey)\n                            .appendTo($name);\n                        if (item._afterAccesskey) {\n                            $name.append(document.createTextNode(item._afterAccesskey));",
        "defaultBranchSha256": "37bde1fa1ccc2e9233c9749193fb87be93e81c98f855b139a0938c6b633acb30"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 39,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 8194,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 8194,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t_selectDate: function( id, dateStr ) {\n\t\tvar onSelect,\n\t\t\ttarget = $( id ),\n\t\t\tinst = this._getInst( target[ 0 ] );\n",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 38,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 8173,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 8173,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\ttarget = $( id );\n\n\t\tif ( $( td ).hasClass( this._unselectableClass ) || this._isDisabledDatepicker( target[ 0 ] ) ) {\n\t\t\treturn;\n\t\t}",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 37,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 8125,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 8125,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t/* Adjust one of the date sub-fields. */\n\t_adjustDate: function( id, offset, period ) {\n\t\tvar target = $( id ),\n\t\t\tinst = this._getInst( target[ 0 ] );\n",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 36,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 8048,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 8048,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t}\n\n\t\tposition = $( obj ).offset();\n\t\treturn [ position.left, position.top ];\n\t},",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 35,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 7946,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 7946,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\tshowAnim = $.datepicker._get( inst, \"showAnim\" );\n\t\t\tduration = $.datepicker._get( inst, \"duration\" );\n\t\t\tinst.dpDiv.css( \"z-index\", datepicker_getZindex( $( input ) ) + 1 );\n\t\t\t$.datepicker._datepickerShowing = true;\n",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 34,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 7921,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 7921,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\n\t\tisFixed = false;\n\t\t$( input ).parents().each( function() {\n\t\t\tisFixed |= $( this ).css( \"position\" ) === \"fixed\";\n\t\t\treturn !isFixed;",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 33,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.colorpicker.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "reportedLine": 1538,
      "inputContract": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "sourceEvidence": {
        "path": "include/js/jquery.colorpicker.js",
        "reportedLine": 1538,
        "builtSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b",
        "reportedSourceExcerpt": "\n\t\t\t\tthis.init = function () {\n\t\t\t\t\tpart = $(html()).appendTo($('.ui-colorpicker-hex-container', inst.dialog));\n\n\t\t\t\t\tinputs.color = $('.ui-colorpicker-hex-input', part);",
        "defaultBranchSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 32,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.colorpicker.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "reportedLine": 1462,
      "inputContract": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "sourceEvidence": {
        "path": "include/js/jquery.colorpicker.js",
        "reportedLine": 1462,
        "builtSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b",
        "reportedSourceExcerpt": "\n\t\t\t\tthis.init = function () {\n\t\t\t\t\tpart = $(html()).appendTo($('.ui-colorpicker-alpha-container', inst.dialog));\n\n\t\t\t\t\t$('.ui-colorpicker-mode', part).click(function () {",
        "defaultBranchSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 31,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.colorpicker.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "reportedLine": 1414,
      "inputContract": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "sourceEvidence": {
        "path": "include/js/jquery.colorpicker.js",
        "reportedLine": 1414,
        "builtSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b",
        "reportedSourceExcerpt": "\n\t\t\t\tthis.init = function () {\n\t\t\t\t\tpart = $(html()).appendTo($('.ui-colorpicker-cmyk-container', inst.dialog));\n\t\t\t\t\t\n\t\t\t\t\tinputs.c = $('.ui-colorpicker-cmyk-c .ui-colorpicker-number', part);",
        "defaultBranchSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 30,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.colorpicker.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "reportedLine": 1366,
      "inputContract": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "sourceEvidence": {
        "path": "include/js/jquery.colorpicker.js",
        "reportedLine": 1366,
        "builtSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b",
        "reportedSourceExcerpt": "\t\t\t\t\tvar data = 0;\n\n\t\t\t\t\tpart = $(html()).appendTo($('.ui-colorpicker-lab-container', inst.dialog));\n\t\t\t\t\t\n\t\t\t\t\tinputs.l = $('.ui-colorpicker-lab-l .ui-colorpicker-number', part);",
        "defaultBranchSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 29,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.colorpicker.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "reportedLine": 1304,
      "inputContract": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "sourceEvidence": {
        "path": "include/js/jquery.colorpicker.js",
        "reportedLine": 1304,
        "builtSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b",
        "reportedSourceExcerpt": "\n\t\t\t\tthis.init = function () {\n\t\t\t\t\tpart = $(_html()).appendTo($('.ui-colorpicker-rgb-container', inst.dialog));\n\n\t\t\t\t\t$('.ui-colorpicker-mode', part).click(function () {",
        "defaultBranchSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 28,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.colorpicker.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "reportedLine": 1244,
      "inputContract": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "sourceEvidence": {
        "path": "include/js/jquery.colorpicker.js",
        "reportedLine": 1244,
        "builtSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b",
        "reportedSourceExcerpt": "\n\t\t\t\tthis.init = function () {\n\t\t\t\t\tpart = $(_html()).appendTo($('.ui-colorpicker-hsv-container', inst.dialog));\n\n\t\t\t\t\t$('.ui-colorpicker-mode', part).click(function () {",
        "defaultBranchSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 27,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.colorpicker.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "reportedLine": 1195,
      "inputContract": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "sourceEvidence": {
        "path": "include/js/jquery.colorpicker.js",
        "reportedLine": 1195,
        "builtSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b",
        "reportedSourceExcerpt": "\n\t\t\t\tthis.init = function () {\n\t\t\t\t\tpart = $(_html()).appendTo($('.ui-colorpicker-preview-container', inst.dialog));\n\n\t\t\t\t\t$('.ui-colorpicker-preview-initial', part).on('click', onclick);",
        "defaultBranchSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 26,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.colorpicker.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "reportedLine": 1019,
      "inputContract": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "sourceEvidence": {
        "path": "include/js/jquery.colorpicker.js",
        "reportedLine": 1019,
        "builtSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b",
        "reportedSourceExcerpt": "\n\t\t\t\tthis.init = function () {\n\t\t\t\t\tpart = $(_html()).appendTo($('.ui-colorpicker-bar-container', inst.dialog));\n\n\t\t\t\t\tpart.on('mousedown', _mousedown);",
        "defaultBranchSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 25,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery.colorpicker.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "reportedLine": 768,
      "inputContract": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "sourceEvidence": {
        "path": "include/js/jquery.colorpicker.js",
        "reportedLine": 768,
        "builtSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b",
        "reportedSourceExcerpt": "\n\t\t\t\tthis.init = function () {\n\t\t\t\t\tpart = $(_html()).appendTo($('.ui-colorpicker-map-container', inst.dialog));\n\n\t\t\t\t\tpart.on('mousedown', _mousedown);",
        "defaultBranchSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 24,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 4651,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 4651,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\toptions = this.options,\n\t\t\tactive = this.active,\n\t\t\tclicked = $( event.currentTarget ),\n\t\t\tclickedIsActive = clicked[ 0 ] === active[ 0 ],\n\t\t\tcollapsing = clickedIsActive && options.collapsible,",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 23,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 915,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 915,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\ttarget = typeof options.of === \"string\" ?\n\t\t\t$( document ).find( options.of ) :\n\t\t\t$( options.of ),\n\n\t\twithin = $.position.getWithinInfo( options.within ),",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 22,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 613,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 613,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\tdelegateElement = this.widget();\n\t\t} else {\n\t\t\telement = delegateElement = $( element );\n\t\t\tthis.bindings = this.bindings.add( element );\n\t\t}",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 21,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 336,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 336,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\t\t// Element is window or document\n\t\t\t\telement.document || element );\n\t\t\tthis.window = $( this.document[ 0 ].defaultView || this.document[ 0 ].parentWindow );\n\t\t}\n",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 20,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 329,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 329,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t\t\t\t}\n\t\t\t} );\n\t\t\tthis.document = $( element.style ?\n\n\t\t\t\t// Element within the document",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 19,
      "rule": "js/unsafe-jquery-plugin",
      "path": "include/js/jquery-ui.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "reportedLine": 311,
      "inputContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "sourceEvidence": {
        "path": "include/js/jquery-ui.js",
        "reportedLine": 311,
        "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
        "reportedSourceExcerpt": "\t_createWidget: function( options, element ) {\n\t\telement = $( element || this.defaultElement || this )[ 0 ];\n\t\tthis.element = $( element );\n\t\tthis.uuid = widgetUuid++;\n\t\tthis.eventNamespace = \".\" + this.widgetName + this.uuid;",
        "defaultBranchSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 9,
      "rule": "js/xss-through-dom",
      "path": "include/js/jquery.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: Reported selector-scoping values reach querySelectorAll, not HTML parsing. The single-tag branch creates an empty attribute-free element from a tag-name match in an inert parsing document. Browser tests cover escaped context IDs and the single-tag branch. General jQuery HTML-construction APIs remain intentional trusted-HTML APIs, not sanitizers.",
      "reportedLine": 9214,
      "inputContract": "Reported selector-scoping values reach querySelectorAll, not HTML parsing. The single-tag branch creates an empty attribute-free element from a tag-name match in an inert parsing document. Browser tests cover escaped context IDs and the single-tag branch. General jQuery HTML-construction APIs remain intentional trusted-HTML APIs, not sanitizers.",
      "sourceEvidence": {
        "path": "include/js/jquery.js",
        "reportedLine": 9214,
        "builtSha256": "f5fb077959ca06faa1dc50761d8bbb836c6c78067932537a2b3fea9e401257c5",
        "reportedSourceExcerpt": "\t// Single tag\n\tif ( parsed ) {\n\t\treturn [ context.createElement( parsed[ 1 ] ) ];\n\t}\n",
        "defaultBranchSha256": "f5fb077959ca06faa1dc50761d8bbb836c6c78067932537a2b3fea9e401257c5"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 8,
      "rule": "js/xss-through-dom",
      "path": "include/js/jquery.multiselect.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Reported insertImage creates an IMG node and reads data-image-src. Core source contains no data-image-src writer; active core calendar/consolidation options are fixed values. The compatibility graph initializer returns a count label. Plugins supplying image URLs must parse and allowlist image protocols; setAttribute alone is not URL validation. The broader optgroup/selectedList HTML contract is distinct from this reported image sink.",
      "reportedLine": 87,
      "inputContract": "Reported insertImage creates an IMG node and reads data-image-src. Core source contains no data-image-src writer; active core calendar/consolidation options are fixed values. The compatibility graph initializer returns a count label. Plugins supplying image URLs must parse and allowlist image protocols; setAttribute alone is not URL validation. The broader optgroup/selectedList HTML contract is distinct from this reported image sink.",
      "sourceEvidence": {
        "path": "include/js/jquery.multiselect.js",
        "reportedLine": 87,
        "builtSha256": "6633a6fab7cfc687b9c8c99d22678b219bddea93bfb096e0f3e95ef51c312deb",
        "reportedSourceExcerpt": "    if (optionImageSrc) {\n      var img = document.createElement('img');\n      img.setAttribute('src', optionImageSrc);\n      span.insertBefore(img, span.firstChild);\n    }",
        "defaultBranchSha256": "6633a6fab7cfc687b9c8c99d22678b219bddea93bfb096e0f3e95ef51c312deb"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 7,
      "rule": "js/double-escaping",
      "path": "include/js/billboard.js",
      "observedState": "dismissed",
      "disposition": "false_positive",
      "evidence": "Scoped reported sink review: No core bb.generate/billboard.generate call was found; asset is exposed for plugins. decodeHTMLEntities normalizes values for URI/style checks, not displayed output encoding. sanitize uses tag/attribute/protocol allowlists; browser tooltip regression checks nested markup, event handlers and encoded schemes while retaining allowed formatting. This finite corpus does not establish that arbitrary custom templates are safe: plugin authors must sanitize untrusted HTML at their own rendering boundary.",
      "reportedLine": 555,
      "inputContract": "No core bb.generate/billboard.generate call was found; asset is exposed for plugins. decodeHTMLEntities normalizes values for URI/style checks, not displayed output encoding. sanitize uses tag/attribute/protocol allowlists; browser tooltip regression checks nested markup, event handlers and encoded schemes while retaining allowed formatting. This finite corpus does not establish that arbitrary custom templates are safe: plugin authors must sanitize untrusted HTML at their own rendering boundary.",
      "sourceEvidence": {
        "path": "include/js/billboard.js",
        "reportedLine": 555,
        "builtSha256": "fef26de08169aa706eca6846952a24de42a149c34169ddd3b066cc7ef74bd447",
        "reportedSourceExcerpt": "];\nfunction decodeHTMLEntities(str) {\n  return str.replace(/&colon;/gi, \":\").replace(/&newline;/gi, \"\\n\").replace(/&tab;/gi, \"\t\").replace(/&nbsp;/gi, \" \").replace(/&lt;/gi, \"<\").replace(/&gt;/gi, \">\").replace(/&amp;/gi, \"&\").replace(/&quot;/gi, '\"').replace(/&apos;/gi, \"'\").replace(/&#(\\d+);?/gi, (_, code) => String.fromCharCode(parseInt(code, 10))).replace(/&#x([0-9a-f]+);?/gi, (_, code) => String.fromCharCode(parseInt(code, 16)));\n}\nfunction isSafeURI(uri) {",
        "defaultBranchSha256": "e661d5f7907f176e4568ee5a599c31e51c3d3f20174d1ad10c5355cd71e0ca04"
      },
      "resolution": "Replace ownership-only rationale with the specific DOM/static-markup/normalization source contract in PR #8298. This conclusion does not apply to arbitrary HTML APIs in the same package."
    },
    {
      "number": 6,
      "rule": "js/incomplete-multi-character-sanitization",
      "path": "include/js/billboard.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "No core bb.generate/billboard.generate call was found; asset is exposed for plugins. decodeHTMLEntities normalizes values for URI/style checks, not displayed output encoding. sanitize uses tag/attribute/protocol allowlists; browser tooltip regression checks nested markup, event handlers and encoded schemes while retaining allowed formatting. This finite corpus does not establish that arbitrary custom templates are safe: plugin authors must sanitize untrusted HTML at their own rendering boundary.",
      "reportedLine": 683,
      "inputContract": "No core bb.generate/billboard.generate call was found; asset is exposed for plugins. decodeHTMLEntities normalizes values for URI/style checks, not displayed output encoding. sanitize uses tag/attribute/protocol allowlists; browser tooltip regression checks nested markup, event handlers and encoded schemes while retaining allowed formatting. This finite corpus does not establish that arbitrary custom templates are safe: plugin authors must sanitize untrusted HTML at their own rendering boundary.",
      "sourceEvidence": {
        "path": "include/js/billboard.js",
        "reportedLine": 683,
        "builtSha256": "fef26de08169aa706eca6846952a24de42a149c34169ddd3b066cc7ef74bd447",
        "reportedSourceExcerpt": "    return str;\n  }\n  return str.replace(\n    /<\\/?[^>]*>|[^<>\\s]+>/g,\n    (match) => {",
        "defaultBranchSha256": "e661d5f7907f176e4568ee5a599c31e51c3d3f20174d1ad10c5355cd71e0ca04"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    },
    {
      "number": 5,
      "rule": "js/identity-replacement",
      "path": "include/js/jquery.tablesorter.widgets.js",
      "observedState": "dismissed",
      "disposition": "reviewed_configuration_contract",
      "evidence": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "reportedLine": 111,
      "inputContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "sourceEvidence": {
        "path": "include/js/jquery.tablesorter.widgets.js",
        "reportedLine": 111,
        "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
        "reportedSourceExcerpt": "\t\t\t\tdate = new Date();\n\t\t\t\tdate.setTime(date.getTime() + (31536e+6)); // 365 days\n\t\t\t\tdocument.cookie = key + '=' + (JSON.stringify(values)).replace(/\\\"/g, '\\\"') + '; expires=' + date.toGMTString() + '; path=/';\n\t\t\t}\n\t\t} else {",
        "defaultBranchSha256": "d73f5328852290c1cd13429dd988c22aa66468a9a6c7d623141b82661142a47f"
      },
      "resolution": "Retain the non-remediation decision for the documented developer API contract/current core caller scope, replacing ownership-only rationale. Do not treat user, database or plugin output as trusted configuration. No core untrusted-data path to this reported sink was identified."
    }
  ],
  "followUpIssue": "https://github.com/Cacti/cacti/issues/8299",
  "implementationPullRequest": "https://github.com/Cacti/cacti/pull/8298",
  "snapshotNote": "observedState records the initial inventory, not live GitHub status. Follow-up actions are described separately.",
  "libraries": {
    "include/js/jquery.tablesorter.js": {
      "version": "2.32.0",
      "builtSha256": "8f7c7b34c63157091766b3412cd8abae35fc7542b4a27f7cc904028fd5241746",
      "coreCallersAndContract": "changelog.php, support.php and graph_xport.php initialize actual tables with a constant headerTemplate and zebra widget. Export column labels are htmle-escaped in graph_xport.php. Lower-level helpers expect table/header/cell DOM objects or developer selectors; header templates intentionally support trusted HTML. Browser sorting/filtering case preserves escaped text.",
      "stableBranchSource": {
        "branch": "1.2.x",
        "present": true,
        "sha256": "78d7efca4f4d4c0b93b8552fec5c52a36866d5059f64f430ba5bbaf7af74d3c4"
      }
    },
    "include/js/jquery.tablesorter.widgets.js": {
      "version": "2.32.0",
      "builtSha256": "36fdc0c907284a098f35296097bb02a2df5278f9321aaf42a4c5623dbc40c6ec",
      "coreCallersAndContract": "Core initializers enable zebra, not filter/resizable/sticky widgets. ts.css class names are package constants. Optional filter CSS/template options and storage IDs are developer configuration, not cell values. Browser case exercises controlled filter and storage APIs, retaining hostile text. Cookie fallback replacement is a redundant no-op, not HTML sanitization. jQuery 4 collection sort is corrected by the asset build.",
      "stableBranchSource": {
        "branch": "1.2.x",
        "present": true,
        "sha256": "08efcb88c8cae759cf07a51f4f53ab879b17550e1db34cac18e1d54311c48650"
      }
    },
    "include/js/jquery-ui.js": {
      "version": "1.14.2",
      "builtSha256": "cca6e2f08d89e40f7f02d5c45ea7ea64ddb732dd70a5573210360217f3d260ac",
      "coreCallersAndContract": "Core creates widgets on selected DOM elements. Geometry/containment values are DOM objects or developer selectors; internal event targets, placeholders and wrappers are DOM nodes. Dialog titles and default tooltip/button text are browser checked. Heading tags are constrained to integer levels 1..6 or span. This does not approve passing untrusted values to optional HTML label/content APIs.",
      "stableBranchSource": {
        "branch": "1.2.x",
        "present": true,
        "sha256": "207e13b063c15aad18b825d372848e9d8ad5e1b95c1359dc49a2791dcc845180"
      }
    },
    "include/js/jquery.js": {
      "version": "4.0.0",
      "builtSha256": "f5fb077959ca06faa1dc50761d8bbb836c6c78067932537a2b3fea9e401257c5",
      "coreCallersAndContract": "Reported selector-scoping values reach querySelectorAll, not HTML parsing. The single-tag branch creates an empty attribute-free element from a tag-name match in an inert parsing document. Browser tests cover escaped context IDs and the single-tag branch. General jQuery HTML-construction APIs remain intentional trusted-HTML APIs, not sanitizers.",
      "stableBranchSource": {
        "branch": "1.2.x",
        "present": true,
        "sha256": "172e81298c6b9b1cfabf182bae2afe7bb5aa9e676c0574311a8caf879f7d7ebd"
      }
    },
    "include/js/jquery.contextMenu.js": {
      "version": "Repository snapshot bcb4aaf4ae37ca6bc6b20398f7fdd054505c927c (upstream version not declared in this copy)",
      "builtSha256": "37bde1fa1ccc2e9233c9749193fb87be93e81c98f855b139a0938c6b633acb30",
      "coreCallersAndContract": "Midwinter navigationBox.js initializes contextMenu at its build boundary. Built-in and bundled tree/table-layout menu names are static text; the context uses the library default document and its selector is generated from box configuration. Access-key names use text/createTextNode, and normalized contexts are DOM nodes. This PR forces plugin menu labels to text and routes explicit HTML items through the shared CactiRenderer.menuFragment boundary with a plain-text fallback. Generic context/selector/HTML APIs still require developer-controlled targets and sanitized input.",
      "stableBranchSource": {
        "branch": "1.2.x",
        "present": false,
        "sha256": null
      }
    },
    "include/js/vendor/daterangepicker/daterangepicker.js": {
      "version": "Repository snapshot bcb4aaf4ae37ca6bc6b20398f7fdd054505c927c (upstream version not declared in this copy)",
      "builtSha256": "fcd8905c436ae2280429abb2ec242095c5317a4295a40f66cfba9da5f95692b4",
      "coreCallersAndContract": "No core daterangepicker initializer or loader was found. Constructor element/parentEl require a developer-controlled DOM target/selector; template is intentionally trusted HTML. Subsequent this.element uses are existing jQuery objects and field values pass to date parsing. External plugins must sanitize custom templates/locale text; no such caller is present in this repository.",
      "stableBranchSource": {
        "branch": "1.2.x",
        "present": false,
        "sha256": null
      }
    },
    "include/js/jstree.js": {
      "version": "3.3.17",
      "builtSha256": "edd6e2947f02b3e7e9320cbc6b7ce5763aeb503373fcb7f90f684db1661d6c3b",
      "coreCallersAndContract": "Core get_node callers use context-menu data.reference DOM elements, or existing node IDs; get_node does not consume label text. vakata.attributes is used internally on existing DOM nodes, with no core direct caller. Server tree labels are htmle-escaped and the editor sets force_text=true. Public selector/node APIs do not promise to sanitize arbitrary HTML supplied by plugin code.",
      "stableBranchSource": {
        "branch": "1.2.x",
        "present": true,
        "sha256": "edd6e2947f02b3e7e9320cbc6b7ce5763aeb503373fcb7f90f684db1661d6c3b"
      }
    },
    "include/js/jquery.colorpicker.js": {
      "version": "Repository snapshot bcb4aaf4ae37ca6bc6b20398f7fdd054505c927c (upstream version not declared in this copy)",
      "builtSha256": "792160ecb59d220639d30e426f6b18ff0a03f4f11190e93920e221376a3ca84b",
      "coreCallersAndContract": "The sole core caller color.php uses defaults; field values are parsed into Color objects. Map/bar sizes and regional labels are developer configuration, not the color value. Preview and hex templates are constant markup; other parts use static default regional values. Plugins must use numeric sizes and trusted/escaped labels. Browser hostile-input and valid-hex cases cover the actual core setup.",
      "stableBranchSource": {
        "branch": "1.2.x",
        "present": true,
        "sha256": "cb8159e8d1414b3cb4eb265524538f1917a9acf97fdef9f092cf06e034ee81da"
      }
    },
    "include/js/jquery.timepicker.js": {
      "version": "Timepicker Addon 1.6.3",
      "builtSha256": "8419cb845f503c624bb78629e27aa44eb7a2f91441b296975cddca51625e185a",
      "coreCallersAndContract": "Core graph/tree datetimepicker calls use constant format/grid settings; scheduler uses static settings plus a server-generated numeric Date. Field values are date/time parser inputs, not template options. Optional regional labels/select formatting are developer configuration requiring escaped text. Core browser case preserves a valid date/time and rejects markup interpretation of field text.",
      "stableBranchSource": {
        "branch": "1.2.x",
        "present": true,
        "sha256": "d05bae41656b213a168776abdaf6b059bd7729636ba9b2e8fe272da772a8efab"
      }
    },
    "include/js/jquery.multiselect.js": {
      "version": "Repository snapshot bcb4aaf4ae37ca6bc6b20398f7fdd054505c927c (upstream version not declared in this copy)",
      "builtSha256": "6633a6fab7cfc687b9c8c99d22678b219bddea93bfb096e0f3e95ef51c312deb",
      "coreCallersAndContract": "Reported insertImage creates an IMG node and reads data-image-src. Core source contains no data-image-src writer; active core calendar/consolidation options are fixed values. The compatibility graph initializer returns a count label. Plugins supplying image URLs must parse and allowlist image protocols; setAttribute alone is not URL validation. The broader optgroup/selectedList HTML contract is distinct from this reported image sink.",
      "stableBranchSource": {
        "branch": "1.2.x",
        "present": true,
        "sha256": "b444b5442077ece68523e3cf8bbf624c047c83f3b7aa339a2621961fcb8b01c8"
      }
    },
    "include/js/billboard.js": {
      "version": "4.1.1",
      "builtSha256": "fef26de08169aa706eca6846952a24de42a149c34169ddd3b066cc7ef74bd447",
      "coreCallersAndContract": "No core bb.generate/billboard.generate call was found; asset is exposed for plugins. decodeHTMLEntities normalizes values for URI/style checks, not displayed output encoding. sanitize uses tag/attribute/protocol allowlists; browser tooltip regression checks nested markup, event handlers and encoded schemes while retaining allowed formatting. This finite corpus does not establish that arbitrary custom templates are safe: plugin authors must sanitize untrusted HTML at their own rendering boundary.",
      "stableBranchSource": {
        "branch": "1.2.x",
        "present": true,
        "sha256": "9f1a4694b6f90a3ab2aa579e30a34fd7127869149d44367ea88d1bcc20bb0b38"
      }
    },
    "include/js/jquery.dropdown.js": {
      "version": "Cacti-authored repository code",
      "builtSha256": "87ba3f9173cec344b5c4b7b491f0b957b55b37f65800ed8a0c8fe2b321f2befb",
      "coreCallersAndContract": "No current core DropDownMenu caller or loader was found. The owned compatibility API now creates structure and labels through DOM/text APIs, validates identifiers and sanitizes supplied menu HTML through one reviewed boundary with explicit protocol checks and plain-text fallback. Browser cases cover formatting, submenu/back navigation, invalid identifiers and sanitizer absence.",
      "stableBranchSource": {
        "branch": "1.2.x",
        "present": true,
        "sha256": "66cc7af07e22c8c34e314d8d9769d298977a74175ce81e61a61a533671292d38"
      }
    }
  },
  "relatedTools": [
    {
      "number": 187,
      "tool": "Semgrep OSS",
      "path": "auth_login.php",
      "reportedLine": 332,
      "disposition": "false_positive",
      "evidence": "get_auth_realms supplies numeric/static realm IDs; provider names use htmle(). Request realm affects only selected=\"selected\" versus an empty string through a boolean comparison. No raw request text reaches the option HTML in this reported statement."
    }
  ]
}