Back to Codebase

Vulnerability Analysis Report

Joomla CMS v4.0.0-alpha4x

Scan ID: SCAN-JOOMLA-CORE-4daMhJ • Hash: 228872c6

Severity Score
Critical
Total Findings
100
Engine Version
ECOMGUARD-HYBRID-AST-1.5
Scan Duration
1.012s

Vulnerability Details

L610

Dynamic Code Execution in HtmlDocument.php

CWE-94
File Location: libraries/src/Document/HtmlDocument.php:610
Security Score:
96 / 100
Confirmed Issue

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. High Severity (Confirmed via full AST flow control tracing). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- return eval($str);
+ // Avoid dynamic function/code evaluation. Rewrite with native callbacks.
L40

Insecure DOM Manipulation (XSS) in associations-edit.es6.js

CWE-79
File Location: media/com_associations/js/associations-edit.es6.js:40
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- html.innerHTML = Joomla.JText._('JGLOBAL_ASSOC_NOT_POSSIBLE');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L248

Insecure DOM Manipulation (XSS) in edit-images.js

CWE-79
File Location: media/com_media/js/edit-images.js:248
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- baseContainer.innerHTML = '';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in mediamanager.min.js

CWE-79
File Location: media/com_media/js/mediamanager.min.js:1
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- !function(t){function e(r){if(n[r])return n[r].exports;var i=n[r]={i:r,l:!1,exports:{}};return t[r].call(i.exports,i,i.exports,e),i.l=!0,i.exports}var n={};e.m=t,e.c=n,e.d=function(t,n,r){e.o(t,n)||Object.defineProperty(t,n,{configurable:!1,enumerable:!0,get:r})},e.n=function(t){var n=t&&t.__esModule?function(){return t.default}:function(){return t};return e.d(n,"a",n),n},e.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},e.p="/",e(e.s=64)}([function(t,e){t.exports=function(t,e,n,r,i){var o,a=t=t||{},s=typeof t.default;"object"!==s&&"function"!==s||(o=t,a=t.default);var c="function"==typeof a?a.options:a;e&&(c.render=e.render,c.staticRenderFns=e.staticRenderFns),r&&(c._scopeId=r);var u;if(i?(u=function(t){t=t||this.$vnode&&this.$vnode.ssrContext||this.parent&&this.parent.$vnode&&this.parent.$vnode.ssrContext,t||"undefined"==typeof __VUE_SSR_CONTEXT__||(t=__VUE_SSR_CONTEXT__),n&&n.call(this,t),t&&t._registeredComponents&&t._registeredComponents.add(i)},c._ssrRegister=u):n&&(u=n),u){var l=c.functional,f=l?c.render:c.beforeCreate;l?c.render=function(t,e){return u.call(e),f(t,e)}:c.beforeCreate=f?[].concat(f,u):[u]}return{esModule:o,exports:a,options:c}}},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0});e.SET_IS_LOADING="SET_IS_LOADING",e.SELECT_DIRECTORY="SELECT_DIRECTORY",e.SELECT_BROWSER_ITEM="SELECT_BROWSER_ITEM",e.SELECT_BROWSER_ITEMS="SELECT_BROWSER_ITEMS",e.UNSELECT_BROWSER_ITEM="UNSELECT_BROWSER_ITEM",e.UNSELECT_ALL_BROWSER_ITEMS="UNSELECT_ALL_BROWSER_ITEMS",e.INCREASE_GRID_SIZE="INCREASE_GRID_SIZE",e.DECREASE_GRID_SIZE="DECREASE_GRID_SIZE",e.LOAD_CONTENTS_SUCCESS="LOAD_CONTENTS_SUCCESS",e.LOAD_FULL_CONTENTS_SUCCESS="LOAD_FULL_CONTENTS_SUCCESS",e.CREATE_DIRECTORY_SUCCESS="CREATE_DIRECTORY_SUCCESS",e.UPLOAD_SUCCESS="UPLOAD_SUCCESS",e.SHOW_CREATE_FOLDER_MODAL="SHOW_CREATE_FOLDER_MODAL",e.HIDE_CREATE_FOLDER_MODAL="HIDE_CREATE_FOLDER_MODAL",e.SHOW_CONFIRM_DELETE_MODAL="SHOW_CONFIRM_DELETE_MODAL",e.HIDE_CONFIRM_DELETE_MODAL="HIDE_CONFIRM_DELETE_MODAL",e.SHOW_INFOBAR="SHOW_INFOBAR",e.HIDE_INFOBAR="HIDE_INFOBAR",e.DELETE_SUCCESS="DELETE_SUCCESS",e.CHANGE_LIST_VIEW="CHANGE_LIST_VIEW",e.SHOW_PREVIEW_MODAL="SHOW_PREVIEW_MODAL",e.HIDE_PREVIEW_MODAL="HIDE_PREVIEW_MODAL",e.SHOW_RENAME_MODAL="SHOW_RENAME_MODAL",e.HIDE_RENAME_MODAL="HIDE_RENAME_MODAL",e.RENAME_SUCCESS="RENAME_SUCCESS",e.SHOW_SHARE_MODAL="SHOW_SHARE_MODAL",e.HIDE_SHARE_MODAL="HIDE_SHARE_MODAL",e.SET_SEARCH_QUERY="SET_SEARCH_QUERY"},function(t,e){var n=t.exports="undefined"!=typeof window&&window.Math==Math?window:"undefined"!=typeof self&&self.Math==Math?self:Function("return this")();"number"==typeof __g&&(__g=n)},function(t,e){var n=t.exports={version:"2.5.7"};"number"==typeof __e&&(__e=n)},function(t,e,n){var r=n(44)("wks"),i=n(45),o=n(2).Symbol,a="function"==typeof o;(t.exports=function(t){return r[t]||(r[t]=a&&o[t]||(a?o:i)("Symbol."+t))}).store=r},function(t,e,n){var r=n(11);t.exports=function(t){if(!r(t))throw TypeError(t+" is not an object!");return t}},function(t,e,n){var r=n(2),i=n(3),o=n(10),a=n(7),s=n(16),c=function(t,e,n){var u,l,f,d=t&c.F,p=t&c.G,v=t&c.S,m=t&c.P,h=t&c.B,_=t&c.W,y=p?i:i[e]||(i[e]={}),g=y.prototype,E=p?r:v?r[e]:(r[e]||{}).prototype;p&&(n=e);for(u in n)(l=!d&&E&&void 0!==E[u])&&s(y,u)||(f=l?E[u]:n[u],y[u]=p&&"function"!=typeof E[u]?n[u]:h&&l?o(f,r):_&&E[u]==f?function(t){var e=function(e,n,r){if(this instanceof t){switch(arguments.length){case 0:return new t;case 1:return new t(e);case 2:return new t(e,n)}return new t(e,n,r)}return t.apply(this,arguments)};return e.prototype=t.prototype,e}(f):m&&"function"==typeof f?o(Function.call,f):f,m&&((y.virtual||(y.virtual={}))[u]=f,t&c.R&&g&&!g[u]&&a(g,u,f)))};c.F=1,c.G=2,c.S=4,c.P=8,c.B=16,c.W=32,c.U=64,c.R=128,t.exports=c},function(t,e,n){var r=n(8),i=n(23);t.exports=n(9)?function(t,e,n){return r.f(t,e,i(1,n))}:function(t,e,n){return t[e]=n,t}},function(t,e,n){var r=n(5),i=n(71),o=n(72),a=Object.defineProperty;e.f=n(9)?Object.defineProperty:function(t,e,n){if(r(t),e=o(e,!0),r(n),i)try{return a(t,e,n)}catch(t){}if("get"in n||"set"in n)throw TypeError("Accessors not supported!");return"value"in n&&(t[e]=n.value),t}},function(t,e,n){t.exports=!n(21)(function(){return 7!=Object.defineProperty({},"a",{get:function(){return 7}}).a})},function(t,e,n){var r=n(15);t.exports=function(t,e,n){if(r(t),void 0===e)return t;switch(n){case 1:return function(n){return t.call(e,n)};case 2:return function(n,r){return t.call(e,n,r)};case 3:return function(n,r,i){return t.call(e,n,r,i)}}return function(){return t.apply(e,arguments)}}},function(t,e){t.exports=function(t){return"object"==typeof t?null!==t:"function"==typeof t}},function(t,e){t.exports={}},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.default={methods:{navigateTo:function(t){this.$store.dispatch("getContents",t)}}}},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),function(t,n){function r(t){return void 0===t||null===t}function i(t){return void 0!==t&&null!==t}function o(t){return!0===t}function a(t){return!1===t}function s(t){return"string"==typeof t||"number"==typeof t||"symbol"==typeof t||"boolean"==typeof t}function c(t){return null!==t&&"object"==typeof t}function u(t){return"[object Object]"===so.call(t)}function l(t){return"[object RegExp]"===so.call(t)}function f(t){var e=parseFloat(String(t));return e>=0&&Math.floor(e)===e&&isFinite(t)}function d(t){return null==t?"":"object"==typeof t?JSON.stringify(t,null,2):String(t)}function p(t){var e=parseFloat(t);return isNaN(e)?t:e}function v(t,e){for(var n=Object.create(null),r=t.split(","),i=0;i<r.length;i++)n[r[i]]=!0;return e?function(t){return n[t.toLowerCase()]}:function(t){return n[t]}}function m(t,e){if(t.length){var n=t.indexOf(e);if(n>-1)return t.splice(n,1)}}function h(t,e){return lo.call(t,e)}function _(t){var e=Object.create(null);return function(n){return e[n]||(e[n]=t(n))}}function y(t,e){function n(n){var r=arguments.length;return r?r>1?t.apply(e,arguments):t.call(e,n):t.call(e)}return n._length=t.length,n}function g(t,e){return t.bind(e)}function E(t,e){e=e||0;for(var n=t.length-e,r=new Array(n);n--;)r[n]=t[n+e];return r}function b(t,e){for(var n in e)t[n]=e[n];return t}function C(t){for(var e={},n=0;n<t.length;n++)t[n]&&b(e,t[n]);return e}function O(t,e,n){}function w(t,e){if(t===e)return!0;var n=c(t),r=c(e);if(!n||!r)return!n&&!r&&String(t)===String(e);try{var i=Array.isArray(t),o=Array.isArray(e);if(i&&o)return t.length===e.length&&t.every(function(t,n){return w(t,e[n])});if(i||o)return!1;var a=Object.keys(t),s=Object.keys(e);return a.length===s.length&&a.every(function(n){return w(t[n],e[n])})}catch(t){return!1}}function S(t,e){for(var n=0;n<t.length;n++)if(w(t[n],e))return n;return-1}function A(t){var e=!1;return function(){e||(e=!0,t.apply(this,arguments))}}function M(t){var e=(t+"").charCodeAt(0);return 36===e||95===e}function I(t,e,n,r){Object.defineProperty(t,e,{value:n,enumerable:!!r,writable:!0,configurable:!0})}function x(t){if(!wo.test(t)){var e=t.split(".");return function(t){for(var n=0;n<e.length;n++){if(!t)return;t=t[e[n]]}return t}}}function T(t){return"function"==typeof t&&/native code/.test(t.toString())}function D(t){Go.target&&Vo.push(Go.target),Go.target=t}function $(){Go.target=Vo.pop()}function L(t){return new zo(void 0,void 0,void 0,String(t))}function k(t){var e=new zo(t.tag,t.data,t.children,t.text,t.elm,t.context,t.componentOptions,t.asyncFactory);return e.ns=t.ns,e.isStatic=t.isStatic,e.key=t.key,e.isComment=t.isComment,e.fnContext=t.fnContext,e.fnOptions=t.fnOptions,e.fnScopeId=t.fnScopeId,e.isCloned=!0,e}function R(t){Xo=t}function N(t,e,n){t.__proto__=e}function P(t,e,n){for(var r=0,i=n.length;r<i;r++){var o=n[r];I(t,o,e[o])}}function j(t,e){if(c(t)&&!(t instanceof zo)){var n;return h(t,"__ob__")&&t.__ob__ instanceof Qo?n=t.__ob__:Xo&&!Fo()&&(Array.isArray(t)||u(t))&&Object.isExtensible(t)&&!t._isVue&&(n=new Qo(t)),e&&n&&n.vmCount++,n}}function F(t,e,n,r,i){var o=new Go,a=Object.getOwnPropertyDescriptor(t,e);if(!a||!1!==a.configurable){var s=a&&a.get;s||2!==arguments.length||(n=t[e]);var c=a&&a.set,u=!i&&j(n);Object.defineProperty(t,e,{enumerable:!0,configurable:!0,get:function(){var e=s?s.call(t):n;return Go.target&&(o.depend(),u&&(u.dep.depend(),Array.isArray(e)&&B(e))),e},set:function(e){var r=s?s.call(t):n;e===r||e!==e&&r!==r||(c?c.call(t,e):n=e,u=!i&&j(e),o.notify())}})}}function H(t,e,n){if(Array.isArray(t)&&f(e))return t.length=Math.max(t.length,e),t.splice(e,1,n),n;if(e in t&&!(e in Object.prototype))return t[e]=n,n;var r=t.__ob__;return t._isVue||r&&r.vmCount?n:r?(F(r.value,e,n),r.dep.notify(),n):(t[e]=n,n)}function U(t,e){if(Array.isArray(t)&&f(e))return void t.splice(e,1);var n=t.__ob__;t._isVue||n&&n.vmCount||h(t,e)&&(delete t[e],n&&n.dep.notify())}function B(t){for(var e=void 0,n=0,r=t.length;n<r;n++)e=t[n],e&&e.__ob__&&e.__ob__.dep.depend(),Array.isArray(e)&&B(e)}function W(t,e){if(!e)return t;for(var n,r,i,o=Object.keys(e),a=0;a<o.length;a++)n=o[a],r=t[n],i=e[n],h(t,n)?u(r)&&u(i)&&W(r,i):H(t,n,i);return t}function G(t,e,n){return n?function(){var r="function"==typeof e?e.call(n,n):e,i="function"==typeof t?t.call(n,n):t;return r?W(r,i):i}:e?t?function(){return W("function"==typeof e?e.call(this,this):e,"function"==typeof t?t.call(this,this):t)}:e:t}function V(t,e){return e?t?t.concat(e):Array.isArray(e)?e:[e]:t}function z(t,e,n,r){var i=Object.create(t||null);return e?b(i,e):i}function J(t,e){var n=t.props;if(n){var r,i,o,a={};if(Array.isArray(n))for(r=n.length;r--;)"string"==typeof(i=n[r])&&(o=po(i),a[o]={type:null});else if(u(n))for(var s in n)i=n[s],o=po(s),a[o]=u(i)?i:{type:i};t.props=a}}function q(t,e){var n=t.inject;if(n){var r=t.inject={};if(Array.isArray(n))for(var i=0;i<n.length;i++)r[n[i]]={from:n[i]};else if(u(n))for(var o in n){var a=n[o];r[o]=u(a)?b({from:o},a):{from:a}}}}function K(t){var e=t.directives;if(e)for(var n in e){var r=e[n];"function"==typeof r&&(e[n]={bind:r,update:r})}}function Y(t,e,n){function r(r){var i=ta[r]||ra;c[r]=i(t[r],e[r],n,r)}"function"==typeof e&&(e=e.options),J(e,n),q(e,n),K(e);var i=e.extends;if(i&&(t=Y(t,i,n)),e.mixins)for(var o=0,a=e.mixins.length;o<a;o++)t=Y(t,e.mixins[o],n);var s,c={};for(s in t)r(s);for(s in e)h(t,s)||r(s);return c}function Z(t,e,n,r){if("string"==typeof n){var i=t[e];if(h(i,n))return i[n];var o=po(n);if(h(i,o))return i[o];var a=vo(o);if(h(i,a))return i[a];return i[n]||i[o]||i[a]}}function X(t,e,n,r){var i=e[t],o=!h(n,t),a=n[t],s=nt(Boolean,i.type);if(s>-1)if(o&&!h(i,"default"))a=!1;else if(""===a||a===ho(t)){var c=nt(String,i.type);(c<0||s<c)&&(a=!0)}if(void 0===a){a=Q(r,i,t);var u=Xo;R(!0),j(a),R(u)}return a}function Q(t,e,n){if(h(e,"default")){var r=e.default;return t&&t.$options.propsData&&void 0===t.$options.propsData[n]&&void 0!==t._props[n]?t._props[n]:"function"==typeof r&&"Function"!==tt(e.type)?r.call(t):r}}function tt(t){var e=t&&t.toString().match(/^\s*function (\w+)/);return e?e[1]:""}function et(t,e){return tt(t)===tt(e)}function nt(t,e){if(!Array.isArray(e))return et(e,t)?0:-1;for(var n=0,r=e.length;n<r;n++)if(et(e[n],t))return n;return-1}function rt(t,e,n){if(e)for(var r=e;r=r.$parent;){var i=r.$options.errorCaptured;if(i)for(var o=0;o<i.length;o++)try{var a=!1===i[o].call(r,t,e,n);if(a)return}catch(t){it(t,r,"errorCaptured hook")}}it(t,e,n)}function it(t,e,n){if(Oo.errorHandler)try{return Oo.errorHandler.call(null,t,e,n)}catch(t){ot(t,null,"config.errorHandler")}ot(t,e,n)}function ot(t,e,n){if(!Ao&&!Mo||"undefined"==typeof console)throw t;console.error(t)}function at(){oa=!1;var t=ia.slice(0);ia.length=0;for(var e=0;e<t.length;e++)t[e]()}function st(t){return t._withTask||(t._withTask=function(){aa=!0;var e=t.apply(null,arguments);return aa=!1,e})}function ct(t,e){var n;if(ia.push(function(){if(t)try{t.call(e)}catch(t){rt(t,e,"nextTick")}else n&&n(e)}),oa||(oa=!0,aa?na():ea()),!t&&"undefined"!=typeof Promise)return new Promise(function(t){n=t})}function ut(t){lt(t,fa),fa.clear()}function lt(t,e){var n,r,i=Array.isArray(t);if(!(!i&&!c(t)||Object.isFrozen(t)||t instanceof zo)){if(t.__ob__){var o=t.__ob__.dep.id;if(e.has(o))return;e.add(o)}if(i)for(n=t.length;n--;)lt(t[n],e);else for(r=Object.keys(t),n=r.length;n--;)lt(t[r[n]],e)}}function ft(t){function e(){var t=arguments,n=e.fns;if(!Array.isArray(n))return n.apply(null,arguments);for(var r=n.slice(),i=0;i<r.length;i++)r[i].apply(null,t)}return e.fns=t,e}function dt(t,e,n,i,o){var a,s,c,u;for(a in t)s=t[a],c=e[a],u=da(a),r(s)||(r(c)?(r(s.fns)&&(s=t[a]=ft(s)),n(u.name,s,u.once,u.capture,u.passive,u.params)):s!==c&&(c.fns=s,t[a]=c));for(a in e)r(t[a])&&(u=da(a),i(u.name,e[a],u.capture))}function pt(t,e,n){function a(){n.apply(this,arguments),m(s.fns,a)}t instanceof zo&&(t=t.data.hook||(t.data.hook={}));var s,c=t[e];r(c)?s=ft([a]):i(c.fns)&&o(c.merged)?(s=c,s.fns.push(a)):s=ft([c,a]),s.merged=!0,t[e]=s}function vt(t,e,n){var o=e.options.props;if(!r(o)){var a={},s=t.attrs,c=t.props;if(i(s)||i(c))for(var u in o){var l=ho(u);mt(a,c,u,l,!0)||mt(a,s,u,l,!1)}return a}}function mt(t,e,n,r,o){if(i(e)){if(h(e,n))return t[n]=e[n],o||delete e[n],!0;if(h(e,r))return t[n]=e[r],o||delete e[r],!0}return!1}function ht(t){for(var e=0;e<t.length;e++)if(Array.isArray(t[e]))return Array.prototype.concat.apply([],t);return t}function _t(t){return s(t)?[L(t)]:Array.isArray(t)?gt(t):void 0}function yt(t){return i(t)&&i(t.text)&&a(t.isComment)}function gt(t,e){var n,a,c,u,l=[];for(n=0;n<t.length;n++)a=t[n],r(a)||"boolean"==typeof a||(c=l.length-1,u=l[c],Array.isArray(a)?a.length>0&&(a=gt(a,(e||"")+"_"+n),yt(a[0])&&yt(u)&&(l[c]=L(u.text+a[0].text),a.shift()),l.push.apply(l,a)):s(a)?yt(u)?l[c]=L(u.text+a):""!==a&&l.push(L(a)):yt(a)&&yt(u)?l[c]=L(u.text+a.text):(o(t._isVList)&&i(a.tag)&&r(a.key)&&i(e)&&(a.key="__vlist"+e+"_"+n+"__"),l.push(a)));return l}function Et(t,e){return(t.__esModule||Uo&&"Module"===t[Symbol.toStringTag])&&(t=t.default),c(t)?e.extend(t):t}function bt(t,e,n,r,i){var o=qo();return o.asyncFactory=t,o.asyncMeta={data:e,context:n,children:r,tag:i},o}function Ct(t,e,n){if(o(t.error)&&i(t.errorComp))return t.errorComp;if(i(t.resolved))return t.resolved;if(o(t.loading)&&i(t.loadingComp))return t.loadingComp;if(!i(t.contexts)){var a=t.contexts=[n],s=!0,u=function(){for(var t=0,e=a.length;t<e;t++)a[t].$forceUpdate()},l=A(function(n){t.resolved=Et(n,e),s||u()}),f=A(function(e){i(t.errorComp)&&(t.error=!0,u())}),d=t(l,f);return c(d)&&("function"==typeof d.then?r(t.resolved)&&d.then(l,f):i(d.component)&&"function"==typeof d.component.then&&(d.component.then(l,f),i(d.error)&&(t.errorComp=Et(d.error,e)),i(d.loading)&&(t.loadingComp=Et(d.loading,e),0===d.delay?t.loading=!0:setTimeout(function(){r(t.resolved)&&r(t.error)&&(t.loading=!0,u())},d.delay||200)),i(d.timeout)&&setTimeout(function(){r(t.resolved)&&f(null)},d.timeout))),s=!1,t.loading?t.loadingComp:t.resolved}t.contexts.push(n)}function Ot(t){return t.isComment&&t.asyncFactory}function wt(t){if(Array.isArray(t))for(var e=0;e<t.length;e++){var n=t[e];if(i(n)&&(i(n.componentOptions)||Ot(n)))return n}}function St(t){t._events=Object.create(null),t._hasHookEvent=!1;var e=t.$options._parentListeners;e&&It(t,e)}function At(t,e,n){n?la.$once(t,e):la.$on(t,e)}function Mt(t,e){la.$off(t,e)}function It(t,e,n){la=t,dt(e,n||{},At,Mt,t),la=void 0}function xt(t,e){var n={};if(!t)return n;for(var r=0,i=t.length;r<i;r++){var o=t[r],a=o.data;if(a&&a.attrs&&a.attrs.slot&&delete a.attrs.slot,o.context!==e&&o.fnContext!==e||!a||null==a.slot)(n.default||(n.default=[])).push(o);else{var s=a.slot,c=n[s]||(n[s]=[]);"template"===o.tag?c.push.apply(c,o.children||[]):c.push(o)}}for(var u in n)n[u].every(Tt)&&delete n[u];return n}function Tt(t){return t.isComment&&!t.asyncFactory||" "===t.text}function Dt(t,e){e=e||{};for(var n=0;n<t.length;n++)Array.isArray(t[n])?Dt(t[n],e):e[t[n].key]=t[n].fn;return e}function $t(t){var e=t.$options,n=e.parent;if(n&&!e.abstract){for(;n.$options.abstract&&n.$parent;)n=n.$parent;n.$children.push(t)}t.$parent=n,t.$root=n?n.$root:t,t.$children=[],t.$refs={},t._watcher=null,t._inactive=null,t._directInactive=!1,t._isMounted=!1,t._isDestroyed=!1,t._isBeingDestroyed=!1}function Lt(t,e,n){t.$el=e,t.$options.render||(t.$options.render=qo),jt(t,"beforeMount");var r;return r=function(){t._update(t._render(),n)},new ba(t,r,O,null,!0),n=!1,null==t.$vnode&&(t._isMounted=!0,jt(t,"mounted")),t}function kt(t,e,n,r,i){var o=!!(i||t.$options._renderChildren||r.data.scopedSlots||t.$scopedSlots!==ao);if(t.$options._parentVnode=r,t.$vnode=r,t._vnode&&(t._vnode.parent=r),t.$options._renderChildren=i,t.$attrs=r.data.attrs||ao,t.$listeners=n||ao,e&&t.$options.props){R(!1);for(var a=t._props,s=t.$options._propKeys||[],c=0;c<s.length;c++){var u=s[c],l=t.$options.props;a[u]=X(u,l,e,t)}R(!0),t.$options.propsData=e}n=n||ao;var f=t.$options._parentListeners;t.$options._parentListeners=n,It(t,n,f),o&&(t.$slots=xt(i,r.context),t.$forceUpdate())}function Rt(t){for(;t&&(t=t.$parent);)if(t._inactive)return!0;return!1}function Nt(t,e){if(e){if(t._directInactive=!1,Rt(t))return}else if(t._directInactive)return;if(t._inactive||null===t._inactive){t._inactive=!1;for(var n=0;n<t.$children.length;n++)Nt(t.$children[n]);jt(t,"activated")}}function Pt(t,e){if(!(e&&(t._directInactive=!0,Rt(t))||t._inactive)){t._inactive=!0;for(var n=0;n<t.$children.length;n++)Pt(t.$children[n]);jt(t,"deactivated")}}function jt(t,e){D();var n=t.$options[e];if(n)for(var r=0,i=n.length;r<i;r++)try{n[r].call(t)}catch(n){rt(n,t,e+" hook")}t._hasHookEvent&&t.$emit("hook:"+e),$()}function Ft(){ga=va.length=ma.length=0,ha={},_a=ya=!1}function Ht(){ya=!0;var t,e;for(va.sort(function(t,e){return t.id-e.id}),ga=0;ga<va.length;ga++)t=va[ga],e=t.id,ha[e]=null,t.run();var n=ma.slice(),r=va.slice();Ft(),Wt(n),Ut(r),Ho&&Oo.devtools&&Ho.emit("flush")}function Ut(t){for(var e=t.length;e--;){var n=t[e],r=n.vm;r._watcher===n&&r._isMounted&&jt(r,"updated")}}function Bt(t){t._inactive=!1,ma.push(t)}function Wt(t){for(var e=0;e<t.length;e++)t[e]._inactive=!0,Nt(t[e],!0)}function Gt(t){var e=t.id;if(null==ha[e]){if(ha[e]=!0,ya){for(var n=va.length-1;n>ga&&va[n].id>t.id;)n--;va.splice(n+1,0,t)}else va.push(t);_a||(_a=!0,ct(Ht))}}function Vt(t,e,n){Ca.get=function(){return this[e][n]},Ca.set=function(t){this[e][n]=t},Object.defineProperty(t,n,Ca)}function zt(t){t._watchers=[];var e=t.$options;e.props&&Jt(t,e.props),e.methods&&Qt(t,e.methods),e.data?qt(t):j(t._data={},!0),e.computed&&Yt(t,e.computed),e.watch&&e.watch!==ko&&te(t,e.watch)}function Jt(t,e){var n=t.$options.propsData||{},r=t._props={},i=t.$options._propKeys=[];!t.$parent||R(!1);for(var o in e)!function(o){i.push(o);var a=X(o,e,n,t);F(r,o,a),o in t||Vt(t,"_props",o)}(o);R(!0)}function qt(t){var e=t.$options.data;e=t._data="function"==typeof e?Kt(e,t):e||{},u(e)||(e={});for(var n=Object.keys(e),r=t.$options.props,i=(t.$options.methods,n.length);i--;){var o=n[i];r&&h(r,o)||M(o)||Vt(t,"_data",o)}j(e,!0)}function Kt(t,e){D();try{return t.call(e,e)}catch(t){return rt(t,e,"data()"),{}}finally{$()}}function Yt(t,e){var n=t._computedWatchers=Object.create(null),r=Fo();for(var i in e){var o=e[i],a="function"==typeof o?o:o.get;r||(n[i]=new ba(t,a||O,O,Oa)),i in t||Zt(t,i,o)}}function Zt(t,e,n){var r=!Fo();"function"==typeof n?(Ca.get=r?Xt(e):n,Ca.set=O):(Ca.get=n.get?r&&!1!==n.cache?Xt(e):n.get:O,Ca.set=n.set?n.set:O),Object.defineProperty(t,e,Ca)}function Xt(t){return function(){var e=this._computedWatchers&&this._computedWatchers[t];if(e)return e.dirty&&e.evaluate(),Go.target&&e.depend(),e.value}}function Qt(t,e){t.$options.props;for(var n in e)t[n]=null==e[n]?O:_o(e[n],t)}function te(t,e){for(var n in e){var r=e[n];if(Array.isArray(r))for(var i=0;i<r.length;i++)ee(t,n,r[i]);else ee(t,n,r)}}function ee(t,e,n,r){return u(n)&&(r=n,n=n.handler),"string"==typeof n&&(n=t[n]),t.$watch(e,n,r)}function ne(t){var e=t.$options.provide;e&&(t._provided="function"==typeof e?e.call(t):e)}function re(t){var e=ie(t.$options.inject,t);e&&(R(!1),Object.keys(e).forEach(function(n){F(t,n,e[n])}),R(!0))}function ie(t,e){if(t){for(var n=Object.create(null),r=Uo?Reflect.ownKeys(t).filter(function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable}):Object.keys(t),i=0;i<r.length;i++){for(var o=r[i],a=t[o].from,s=e;s;){if(s._provided&&h(s._provided,a)){n[o]=s._provided[a];break}s=s.$parent}if(!s&&"default"in t[o]){var c=t[o].default;n[o]="function"==typeof c?c.call(e):c}}return n}}function oe(t,e){var n,r,o,a,s;if(Array.isArray(t)||"string"==typeof t)for(n=new Array(t.length),r=0,o=t.length;r<o;r++)n[r]=e(t[r],r);else if("number"==typeof t)for(n=new Array(t),r=0;r<t;r++)n[r]=e(r+1,r);else if(c(t))for(a=Object.keys(t),n=new Array(a.length),r=0,o=a.length;r<o;r++)s=a[r],n[r]=e(t[s],s,r);return i(n)&&(n._isVList=!0),n}function ae(t,e,n,r){var i,o=this.$scopedSlots[t];if(o)n=n||{},r&&(n=b(b({},r),n)),i=o(n)||e;else{var a=this.$slots[t];a&&(a._rendered=!0),i=a||e}var s=n&&n.slot;return s?this.$createElement("template",{slot:s},i):i}function se(t){return Z(this.$options,"filters",t,!0)||go}function ce(t,e){return Array.isArray(t)?-1===t.indexOf(e):t!==e}function ue(t,e,n,r,i){var o=Oo.keyCodes[e]||n;return i&&r&&!Oo.keyCodes[e]?ce(i,r):o?ce(o,t):r?ho(r)!==e:void 0}function le(t,e,n,r,i){if(n)if(c(n)){Array.isArray(n)&&(n=C(n));var o;for(var a in n)!function(a){if("class"===a||"style"===a||uo(a))o=t;else{var s=t.attrs&&t.attrs.type;o=r||Oo.mustUseProp(e,s,a)?t.domProps||(t.domProps={}):t.attrs||(t.attrs={})}if(!(a in o)&&(o[a]=n[a],i)){(t.on||(t.on={}))["update:"+a]=function(t){n[a]=t}}}(a)}else;return t}function fe(t,e){var n=this._staticTrees||(this._staticTrees=[]),r=n[t];return r&&!e?r:(r=n[t]=this.$options.staticRenderFns[t].call(this._renderProxy,null,this),pe(r,"__static__"+t,!1),r)}function de(t,e,n){return pe(t,"__once__"+e+(n?"_"+n:""),!0),t}function pe(t,e,n){if(Array.isArray(t))for(var r=0;r<t.length;r++)t[r]&&"string"!=typeof t[r]&&ve(t[r],e+"_"+r,n);else ve(t,e,n)}function ve(t,e,n){t.isStatic=!0,t.key=e,t.isOnce=n}function me(t,e){if(e)if(u(e)){var n=t.on=t.on?b({},t.on):{};for(var r in e){var i=n[r],o=e[r];n[r]=i?[].concat(i,o):o}}else;return t}function he(t){t._o=de,t._n=p,t._s=d,t._l=oe,t._t=ae,t._q=w,t._i=S,t._m=fe,t._f=se,t._k=ue,t._b=le,t._v=L,t._e=qo,t._u=Dt,t._g=me}function _e(t,e,n,r,i){var a,s=i.options;h(r,"_uid")?(a=Object.create(r),a._original=r):(a=r,r=r._original);var c=o(s._compiled),u=!c;this.data=t,this.props=e,this.children=n,this.parent=r,this.listeners=t.on||ao,this.injections=ie(s.inject,r),this.slots=function(){return xt(n,r)},c&&(this.$options=s,this.$slots=this.slots(),this.$scopedSlots=t.scopedSlots||ao),s._scopeId?this._c=function(t,e,n,i){var o=Se(a,t,e,n,i,u);return o&&!Array.isArray(o)&&(o.fnScopeId=s._scopeId,o.fnContext=r),o}:this._c=function(t,e,n,r){return Se(a,t,e,n,r,u)}}function ye(t,e,n,r,o){var a=t.options,s={},c=a.props;if(i(c))for(var u in c)s[u]=X(u,c,e||ao);else i(n.attrs)&&Ee(s,n.attrs),i(n.props)&&Ee(s,n.props);var l=new _e(n,s,o,r,t),f=a.render.call(null,l._c,l);if(f instanceof zo)return ge(f,n,l.parent,a);if(Array.isArray(f)){for(var d=_t(f)||[],p=new Array(d.length),v=0;v<d.length;v++)p[v]=ge(d[v],n,l.parent,a);return p}}function ge(t,e,n,r){var i=k(t);return i.fnContext=n,i.fnOptions=r,e.slot&&((i.data||(i.data={})).slot=e.slot),i}function Ee(t,e){for(var n in e)t[po(n)]=e[n]}function be(t,e,n,a,s){if(!r(t)){var u=n.$options._base;if(c(t)&&(t=u.extend(t)),"function"==typeof t){var l;if(r(t.cid)&&(l=t,void 0===(t=Ct(l,u,n))))return bt(l,e,n,a,s);e=e||{},De(t),i(e.model)&&we(t.options,e);var f=vt(e,t,s);if(o(t.options.functional))return ye(t,f,e,n,a);var d=e.on;if(e.on=e.nativeOn,o(t.options.abstract)){var p=e.slot;e={},p&&(e.slot=p)}Oe(e);var v=t.options.name||s;return new zo("vue-component-"+t.cid+(v?"-"+v:""),e,void 0,void 0,void 0,n,{Ctor:t,propsData:f,listeners:d,tag:s,children:a},l)}}}function Ce(t,e,n,r){var o={_isComponent:!0,parent:e,_parentVnode:t,_parentElm:n||null,_refElm:r||null},a=t.data.inlineTemplate;return i(a)&&(o.render=a.render,o.staticRenderFns=a.staticRenderFns),new t.componentOptions.Ctor(o)}function Oe(t){for(var e=t.hook||(t.hook={}),n=0;n<Sa.length;n++){var r=Sa[n];e[r]=wa[r]}}function we(t,e){var n=t.model&&t.model.prop||"value",r=t.model&&t.model.event||"input";(e.props||(e.props={}))[n]=e.model.value;var o=e.on||(e.on={});i(o[r])?o[r]=[e.model.callback].concat(o[r]):o[r]=e.model.callback}function Se(t,e,n,r,i,a){return(Array.isArray(n)||s(n))&&(i=r,r=n,n=void 0),o(a)&&(i=Ma),Ae(t,e,n,r,i)}function Ae(t,e,n,r,o){if(i(n)&&i(n.__ob__))return qo();if(i(n)&&i(n.is)&&(e=n.is),!e)return qo();Array.isArray(r)&&"function"==typeof r[0]&&(n=n||{},n.scopedSlots={default:r[0]},r.length=0),o===Ma?r=_t(r):o===Aa&&(r=ht(r));var a,s;if("string"==typeof e){var c;s=t.$vnode&&t.$vnode.ns||Oo.getTagNamespace(e),a=Oo.isReservedTag(e)?new zo(Oo.parsePlatformTagName(e),n,r,void 0,void 0,t):i(c=Z(t.$options,"components",e))?be(c,n,t,r,e):new zo(e,n,r,void 0,void 0,t)}else a=be(e,n,t,r);return Array.isArray(a)?a:i(a)?(i(s)&&Me(a,s),i(n)&&Ie(n),a):qo()}function Me(t,e,n){if(t.ns=e,"foreignObject"===t.tag&&(e=void 0,n=!0),i(t.children))for(var a=0,s=t.children.length;a<s;a++){var c=t.children[a];i(c.tag)&&(r(c.ns)||o(n)&&"svg"!==c.tag)&&Me(c,e,n)}}function Ie(t){c(t.style)&&ut(t.style),c(t.class)&&ut(t.class)}function xe(t){t._vnode=null,t._staticTrees=null;var e=t.$options,n=t.$vnode=e._parentVnode,r=n&&n.context;t.$slots=xt(e._renderChildren,r),t.$scopedSlots=ao,t._c=function(e,n,r,i){return Se(t,e,n,r,i,!1)},t.$createElement=function(e,n,r,i){return Se(t,e,n,r,i,!0)};var i=n&&n.data;F(t,"$attrs",i&&i.attrs||ao,null,!0),F(t,"$listeners",e._parentListeners||ao,null,!0)}function Te(t,e){var n=t.$options=Object.create(t.constructor.options),r=e._parentVnode;n.parent=e.parent,n._parentVnode=r,n._parentElm=e._parentElm,n._refElm=e._refElm;var i=r.componentOptions;n.propsData=i.propsData,n._parentListeners=i.listeners,n._renderChildren=i.children,n._componentTag=i.tag,e.render&&(n.render=e.render,n.staticRenderFns=e.staticRenderFns)}function De(t){var e=t.options;if(t.super){var n=De(t.super);if(n!==t.superOptions){t.superOptions=n;var r=$e(t);r&&b(t.extendOptions,r),e=t.options=Y(n,t.extendOptions),e.name&&(e.components[e.name]=t)}}return e}function $e(t){var e,n=t.options,r=t.extendOptions,i=t.sealedOptions;for(var o in n)n[o]!==i[o]&&(e||(e={}),e[o]=Le(n[o],r[o],i[o]));return e}function Le(t,e,n){if(Array.isArray(t)){var r=[];n=Array.isArray(n)?n:[n],e=Array.isArray(e)?e:[e];for(var i=0;i<t.length;i++)(e.indexOf(t[i])>=0||n.indexOf(t[i])<0)&&r.push(t[i]);return r}return t}function ke(t){this._init(t)}function Re(t){t.use=function(t){var e=this._installedPlugins||(this._installedPlugins=[]);if(e.indexOf(t)>-1)return this;var n=E(arguments,1);return n.unshift(this),"function"==typeof t.install?t.install.apply(t,n):"function"==typeof t&&t.apply(null,n),e.push(t),this}}function Ne(t){t.mixin=function(t){return this.options=Y(this.options,t),this}}function Pe(t){t.cid=0;var e=1;t.extend=function(t){t=t||{};var n=this,r=n.cid,i=t._Ctor||(t._Ctor={});if(i[r])return i[r];var o=t.name||n.options.name,a=function(t){this._init(t)};return a.prototype=Object.create(n.prototype),a.prototype.constructor=a,a.cid=e++,a.options=Y(n.options,t),a.super=n,a.options.props&&je(a),a.options.computed&&Fe(a),a.extend=n.extend,a.mixin=n.mixin,a.use=n.use,bo.forEach(function(t){a[t]=n[t]}),o&&(a.options.components[o]=a),a.superOptions=n.options,a.extendOptions=t,a.sealedOptions=b({},a.options),i[r]=a,a}}function je(t){var e=t.options.props;for(var n in e)Vt(t.prototype,"_props",n)}function Fe(t){var e=t.options.computed;for(var n in e)Zt(t.prototype,n,e[n])}function He(t){bo.forEach(function(e){t[e]=function(t,n){return n?("component"===e&&u(n)&&(n.name=n.name||t,n=this.options._base.extend(n)),"directive"===e&&"function"==typeof n&&(n={bind:n,update:n}),this.options[e+"s"][t]=n,n):this.options[e+"s"][t]}})}function Ue(t){return t&&(t.Ctor.options.name||t.tag)}function Be(t,e){return Array.isArray(t)?t.indexOf(e)>-1:"string"==typeof t?t.split(",").indexOf(e)>-1:!!l(t)&&t.test(e)}function We(t,e){var n=t.cache,r=t.keys,i=t._vnode;for(var o in n){var a=n[o];if(a){var s=Ue(a.componentOptions);s&&!e(s)&&Ge(n,o,r,i)}}}function Ge(t,e,n,r){var i=t[e];!i||r&&i.tag===r.tag||i.componentInstance.$destroy(),t[e]=null,m(n,e)}function Ve(t){for(var e=t.data,n=t,r=t;i(r.componentInstance);)(r=r.componentInstance._vnode)&&r.data&&(e=ze(r.data,e));for(;i(n=n.parent);)n&&n.data&&(e=ze(e,n.data));return Je(e.staticClass,e.class)}function ze(t,e){return{staticClass:qe(t.staticClass,e.staticClass),class:i(t.class)?[t.class,e.class]:e.class}}function Je(t,e){return i(t)||i(e)?qe(t,Ke(e)):""}function qe(t,e){return t?e?t+" "+e:t:e||""}function Ke(t){return Array.isArray(t)?Ye(t):c(t)?Ze(t):"string"==typeof t?t:""}function Ye(t){for(var e,n="",r=0,o=t.length;r<o;r++)i(e=Ke(t[r]))&&""!==e&&(n&&(n+=" "),n+=e);return n}function Ze(t){var e="";for(var n in t)t[n]&&(e&&(e+=" "),e+=n);return e}function Xe(t){return Xa(t)?"svg":"math"===t?"math":void 0}function Qe(t){if(!Ao)return!0;if(ts(t))return!1;if(t=t.toLowerCase(),null!=es[t])return es[t];var e=document.createElement(t);return t.indexOf("-")>-1?es[t]=e.constructor===window.HTMLUnknownElement||e.constructor===window.HTMLElement:es[t]=/HTMLUnknownElement/.test(e.toString())}function tn(t){if("string"==typeof t){var e=document.querySelector(t);return e||document.createElement("div")}return t}function en(t,e){var n=document.createElement(t);return"select"!==t?n:(e.data&&e.data.attrs&&void 0!==e.data.attrs.multiple&&n.setAttribute("multiple","multiple"),n)}function nn(t,e){return document.createElementNS(Ya[t],e)}function rn(t){return document.createTextNode(t)}function on(t){return document.createComment(t)}function an(t,e,n){t.insertBefore(e,n)}function sn(t,e){t.removeChild(e)}function cn(t,e){t.appendChild(e)}function un(t){return t.parentNode}function ln(t){return t.nextSibling}function fn(t){return t.tagName}function dn(t,e){t.textContent=e}function pn(t,e){t.setAttribute(e,"")}function vn(t,e){var n=t.data.ref;if(i(n)){var r=t.context,o=t.componentInstance||t.elm,a=r.$refs;e?Array.isArray(a[n])?m(a[n],o):a[n]===o&&(a[n]=void 0):t.data.refInFor?Array.isArray(a[n])?a[n].indexOf(o)<0&&a[n].push(o):a[n]=[o]:a[n]=o}}function mn(t,e){return t.key===e.key&&(t.tag===e.tag&&t.isComment===e.isComment&&i(t.data)===i(e.data)&&hn(t,e)||o(t.isAsyncPlaceholder)&&t.asyncFactory===e.asyncFactory&&r(e.asyncFactory.error))}function hn(t,e){if("input"!==t.tag)return!0;var n,r=i(n=t.data)&&i(n=n.attrs)&&n.type,o=i(n=e.data)&&i(n=n.attrs)&&n.type;return r===o||ns(r)&&ns(o)}function _n(t,e,n){var r,o,a={};for(r=e;r<=n;++r)o=t[r].key,i(o)&&(a[o]=r);return a}function yn(t,e){(t.data.directives||e.data.directives)&&gn(t,e)}function gn(t,e){var n,r,i,o=t===os,a=e===os,s=En(t.data.directives,t.context),c=En(e.data.directives,e.context),u=[],l=[];for(n in c)r=s[n],i=c[n],r?(i.oldValue=r.value,Cn(i,"update",e,t),i.def&&i.def.componentUpdated&&l.push(i)):(Cn(i,"bind",e,t),i.def&&i.def.inserted&&u.push(i));if(u.length){var f=function(){for(var n=0;n<u.length;n++)Cn(u[n],"inserted",e,t)};o?pt(e,"insert",f):f()}if(l.length&&pt(e,"postpatch",function(){for(var n=0;n<l.length;n++)Cn(l[n],"componentUpdated",e,t)}),!o)for(n in s)c[n]||Cn(s[n],"unbind",t,t,a)}function En(t,e){var n=Object.create(null);if(!t)return n;var r,i;for(r=0;r<t.length;r++)i=t[r],i.modifiers||(i.modifiers=cs),n[bn(i)]=i,i.def=Z(e.$options,"directives",i.name,!0);return n}function bn(t){return t.rawName||t.name+"."+Object.keys(t.modifiers||{}).join(".")}function Cn(t,e,n,r,i){var o=t.def&&t.def[e];if(o)try{o(n.elm,t,n,r,i)}catch(r){rt(r,n.context,"directive "+t.name+" "+e+" hook")}}function On(t,e){var n=e.componentOptions;if(!(i(n)&&!1===n.Ctor.options.inheritAttrs||r(t.data.attrs)&&r(e.data.attrs))){var o,a,s=e.elm,c=t.data.attrs||{},u=e.data.attrs||{};i(u.__ob__)&&(u=e.data.attrs=b({},u));for(o in u)a=u[o],c[o]!==a&&wn(s,o,a);(To||$o)&&u.value!==c.value&&wn(s,"value",u.value);for(o in c)r(u[o])&&(Ja(o)?s.removeAttributeNS(za,qa(o)):Ga(o)||s.removeAttribute(o))}}function wn(t,e,n){t.tagName.indexOf("-")>-1?Sn(t,e,n):Va(e)?Ka(n)?t.removeAttribute(e):(n="allowfullscreen"===e&&"EMBED"===t.tagName?"true":e,t.setAttribute(e,n)):Ga(e)?t.setAttribute(e,Ka(n)||"false"===n?"false":"true"):Ja(e)?Ka(n)?t.removeAttributeNS(za,qa(e)):t.setAttributeNS(za,e,n):Sn(t,e,n)}function Sn(t,e,n){if(Ka(n))t.removeAttribute(e);else{if(To&&!Do&&"TEXTAREA"===t.tagName&&"placeholder"===e&&!t.__ieph){var r=function(e){e.stopImmediatePropagation(),t.removeEventListener("input",r)};t.addEventListener("input",r),t.__ieph=!0}t.setAttribute(e,n)}}function An(t,e){var n=e.elm,o=e.data,a=t.data;if(!(r(o.staticClass)&&r(o.class)&&(r(a)||r(a.staticClass)&&r(a.class)))){var s=Ve(e),c=n._transitionClasses;i(c)&&(s=qe(s,Ke(c))),s!==n._prevClass&&(n.setAttribute("class",s),n._prevClass=s)}}function Mn(t){function e(){(a||(a=[])).push(t.slice(v,i).trim()),v=i+1}var n,r,i,o,a,s=!1,c=!1,u=!1,l=!1,f=0,d=0,p=0,v=0;for(i=0;i<t.length;i++)if(r=n,n=t.charCodeAt(i),s)39===n&&92!==r&&(s=!1);else if(c)34===n&&92!==r&&(c=!1);else if(u)96===n&&92!==r&&(u=!1);else if(l)47===n&&92!==r&&(l=!1);else if(124!==n||124===t.charCodeAt(i+1)||124===t.charCodeAt(i-1)||f||d||p){switch(n){case 34:c=!0;break;case 39:s=!0;break;case 96:u=!0;break;case 40:p++;break;case 41:p--;break;case 91:d++;break;case 93:d--;break;case 123:f++;break;case 125:f--}if(47===n){for(var m=i-1,h=void 0;m>=0&&" "===(h=t.charAt(m));m--);h&&ds.test(h)||(l=!0)}}else void 0===o?(v=i+1,o=t.slice(0,i).trim()):e();if(void 0===o?o=t.slice(0,i).trim():0!==v&&e(),a)for(i=0;i<a.length;i++)o=In(o,a[i]);return o}function In(t,e){var n=e.indexOf("(");if(n<0)return'_f("'+e+'")('+t+")";var r=e.slice(0,n),i=e.slice(n+1);return'_f("'+r+'")('+t+(")"!==i?","+i:i)}function xn(t){console.error("[Vue compiler]: "+t)}function Tn(t,e){return t?t.map(function(t){return t[e]}).filter(function(t){return t}):[]}function Dn(t,e,n){(t.props||(t.props=[])).push({name:e,value:n}),t.plain=!1}function $n(t,e,n){(t.attrs||(t.attrs=[])).push({name:e,value:n}),t.plain=!1}function Ln(t,e,n){t.attrsMap[e]=n,t.attrsList.push({name:e,value:n})}function kn(t,e,n,r,i,o){(t.directives||(t.directives=[])).push({name:e,rawName:n,value:r,arg:i,modifiers:o}),t.plain=!1}function Rn(t,e,n,r,i,o){r=r||ao,r.capture&&(delete r.capture,e="!"+e),r.once&&(delete r.once,e="~"+e),r.passive&&(delete r.passive,e="&"+e),"click"===e&&(r.right?(e="contextmenu",delete r.right):r.middle&&(e="mouseup"));var a;r.native?(delete r.native,a=t.nativeEvents||(t.nativeEvents={})):a=t.events||(t.events={});var s={value:n.trim()};r!==ao&&(s.modifiers=r);var c=a[e];Array.isArray(c)?i?c.unshift(s):c.push(s):a[e]=c?i?[s,c]:[c,s]:s,t.plain=!1}function Nn(t,e,n){var r=Pn(t,":"+e)||Pn(t,"v-bind:"+e);if(null!=r)return Mn(r);if(!1!==n){var i=Pn(t,e);if(null!=i)return JSON.stringify(i)}}function Pn(t,e,n){var r;if(null!=(r=t.attrsMap[e]))for(var i=t.attrsList,o=0,a=i.length;o<a;o++)if(i[o].name===e){i.splice(o,1);break}return n&&delete t.attrsMap[e],r}function jn(t,e,n){var r=n||{},i=r.number,o=r.trim,a="$$v";o&&(a="(typeof $$v === 'string'? $$v.trim(): $$v)"),i&&(a="_n("+a+")");var s=Fn(e,a);t.model={value:"("+e+")",expression:'"'+e+'"',callback:"function ($$v) {"+s+"}"}}function Fn(t,e){var n=Hn(t);return null===n.key?t+"="+e:"$set("+n.exp+", "+n.key+", "+e+")"}function Hn(t){if(t=t.trim(),$a=t.length,t.indexOf("[")<0||t.lastIndexOf("]")<$a-1)return Ra=t.lastIndexOf("."),Ra>-1?{exp:t.slice(0,Ra),key:'"'+t.slice(Ra+1)+'"'}:{exp:t,key:null};for(La=t,Ra=Na=Pa=0;!Bn();)ka=Un(),Wn(ka)?Vn(ka):91===ka&&Gn(ka);return{exp:t.slice(0,Na),key:t.slice(Na+1,Pa)}}function Un(){return La.charCodeAt(++Ra)}function Bn(){return Ra>=$a}function Wn(t){return 34===t||39===t}function Gn(t){var e=1;for(Na=Ra;!Bn();)if(t=Un(),Wn(t))Vn(t);else if(91===t&&e++,93===t&&e--,0===e){Pa=Ra;break}}function Vn(t){for(var e=t;!Bn()&&(t=Un())!==e;);}function zn(t,e,n){ja=n;var r=e.value,i=e.modifiers,o=t.tag,a=t.attrsMap.type;if(t.component)return jn(t,r,i),!1;if("select"===o)Kn(t,r,i);else if("input"===o&&"checkbox"===a)Jn(t,r,i);else if("input"===o&&"radio"===a)qn(t,r,i);else if("input"===o||"textarea"===o)Yn(t,r,i);else if(!Oo.isReservedTag(o))return jn(t,r,i),!1;return!0}function Jn(t,e,n){var r=n&&n.number,i=Nn(t,"value")||"null",o=Nn(t,"true-value")||"true",a=Nn(t,"false-value")||"false";Dn(t,"checked","Array.isArray("+e+")?_i("+e+","+i+")>-1"+("true"===o?":("+e+")":":_q("+e+","+o+")")),Rn(t,"change","var $$a="+e+",$$el=$event.target,$$c=$$el.checked?("+o+"):("+a+");if(Array.isArray($$a)){var $$v="+(r?"_n("+i+")":i)+",$$i=_i($$a,$$v);if($$el.checked){$$i<0&&("+Fn(e,"$$a.concat([$$v])")+")}else{$$i>-1&&("+Fn(e,"$$a.slice(0,$$i).concat($$a.slice($$i+1))")+")}}else{"+Fn(e,"$$c")+"}",null,!0)}function qn(t,e,n){var r=n&&n.number,i=Nn(t,"value")||"null";i=r?"_n("+i+")":i,Dn(t,"checked","_q("+e+","+i+")"),Rn(t,"change",Fn(e,i),null,!0)}function Kn(t,e,n){var r=n&&n.number,i='Array.prototype.filter.call($event.target.options,function(o){return o.selected}).map(function(o){var val = "_value" in o ? o._value : o.value;return '+(r?"_n(val)":"val")+"})",o="var $$selectedVal = "+i+";";o=o+" "+Fn(e,"$event.target.multiple ? $$selectedVal : $$selectedVal[0]"),Rn(t,"change",o,null,!0)}function Yn(t,e,n){var r=t.attrsMap.type,i=n||{},o=i.lazy,a=i.number,s=i.trim,c=!o&&"range"!==r,u=o?"change":"range"===r?ps:"input",l="$event.target.value";s&&(l="$event.target.value.trim()"),a&&(l="_n("+l+")");var f=Fn(e,l);c&&(f="if($event.target.composing)return;"+f),Dn(t,"value","("+e+")"),Rn(t,u,f,null,!0),(s||a)&&Rn(t,"blur","$forceUpdate()")}function Zn(t){if(i(t[ps])){var e=To?"change":"input";t[e]=[].concat(t[ps],t[e]||[]),delete t[ps]}i(t[vs])&&(t.change=[].concat(t[vs],t.change||[]),delete t[vs])}function Xn(t,e,n){var r=Fa;return function i(){null!==t.apply(null,arguments)&&tr(e,i,n,r)}}function Qn(t,e,n,r,i){e=st(e),n&&(e=Xn(e,t,r)),Fa.addEventListener(t,e,Ro?{capture:r,passive:i}:r)}function tr(t,e,n,r){(r||Fa).removeEventListener(t,e._withTask||e,n)}function er(t,e){if(!r(t.data.on)||!r(e.data.on)){var n=e.data.on||{},i=t.data.on||{};Fa=e.elm,Zn(n),dt(n,i,Qn,tr,e.context),Fa=void 0}}function nr(t,e){if(!r(t.data.domProps)||!r(e.data.domProps)){var n,o,a=e.elm,s=t.data.domProps||{},c=e.data.domProps||{};i(c.__ob__)&&(c=e.data.domProps=b({},c));for(n in s)r(c[n])&&(a[n]="");for(n in c){if(o=c[n],"textContent"===n||"innerHTML"===n){if(e.children&&(e.children.length=0),o===s[n])continue;1===a.childNodes.length&&a.removeChild(a.childNodes[0])}if("value"===n){a._value=o;var u=r(o)?"":String(o);rr(a,u)&&(a.value=u)}else a[n]=o}}}function rr(t,e){return!t.composing&&("OPTION"===t.tagName||ir(t,e)||or(t,e))}function ir(t,e){var n=!0;try{n=document.activeElement!==t}catch(t){}return n&&t.value!==e}function or(t,e){var n=t.value,r=t._vModifiers;if(i(r)){if(r.lazy)return!1;if(r.number)return p(n)!==p(e);if(r.trim)return n.trim()!==e.trim()}return n!==e}function ar(t){var e=sr(t.style);return t.staticStyle?b(t.staticStyle,e):e}function sr(t){return Array.isArray(t)?C(t):"string"==typeof t?_s(t):t}function cr(t,e){var n,r={};if(e)for(var i=t;i.componentInstance;)(i=i.componentInstance._vnode)&&i.data&&(n=ar(i.data))&&b(r,n);(n=ar(t.data))&&b(r,n);for(var o=t;o=o.parent;)o.data&&(n=ar(o.data))&&b(r,n);return r}function ur(t,e){var n=e.data,o=t.data;if(!(r(n.staticStyle)&&r(n.style)&&r(o.staticStyle)&&r(o.style))){var a,s,c=e.elm,u=o.staticStyle,l=o.normalizedStyle||o.style||{},f=u||l,d=sr(e.data.style)||{};e.data.normalizedStyle=i(d.__ob__)?b({},d):d;var p=cr(e,!0);for(s in f)r(p[s])&&Es(c,s,"");for(s in p)(a=p[s])!==f[s]&&Es(c,s,null==a?"":a)}}function lr(t,e){if(e&&(e=e.trim()))if(t.classList)e.indexOf(" ")>-1?e.split(/\s+/).forEach(function(e){return t.classList.add(e)}):t.classList.add(e);else{var n=" "+(t.getAttribute("class")||"")+" ";n.indexOf(" "+e+" ")<0&&t.setAttribute("class",(n+e).trim())}}function fr(t,e){if(e&&(e=e.trim()))if(t.classList)e.indexOf(" ")>-1?e.split(/\s+/).forEach(function(e){return t.classList.remove(e)}):t.classList.remove(e),t.classList.length||t.removeAttribute("class");else{for(var n=" "+(t.getAttribute("class")||"")+" ",r=" "+e+" ";n.indexOf(r)>=0;)n=n.replace(r," ");n=n.trim(),n?t.setAttribute("class",n):t.removeAttribute("class")}}function dr(t){if(t){if("object"==typeof t){var e={};return!1!==t.css&&b(e,ws(t.name||"v")),b(e,t),e}return"string"==typeof t?ws(t):void 0}}function pr(t){$s(function(){$s(t)})}function vr(t,e){var n=t._transitionClasses||(t._transitionClasses=[]);n.indexOf(e)<0&&(n.push(e),lr(t,e))}function mr(t,e){t._transitionClasses&&m(t._transitionClasses,e),fr(t,e)}function hr(t,e,n){var r=_r(t,e),i=r.type,o=r.timeout,a=r.propCount;if(!i)return n();var s=i===As?xs:Ds,c=0,u=function(){t.removeEventListener(s,l),n()},l=function(e){e.target===t&&++c>=a&&u()};setTimeout(function(){c<a&&u()},o+1),t.addEventListener(s,l)}function _r(t,e){var n,r=window.getComputedStyle(t),i=r[Is+"Delay"].split(", "),o=r[Is+"Duration"].split(", "),a=yr(i,o),s=r[Ts+"Delay"].split(", "),c=r[Ts+"Duration"].split(", "),u=yr(s,c),l=0,f=0;return e===As?a>0&&(n=As,l=a,f=o.length):e===Ms?u>0&&(n=Ms,l=u,f=c.length):(l=Math.max(a,u),n=l>0?a>u?As:Ms:null,f=n?n===As?o.length:c.length:0),{type:n,timeout:l,propCount:f,hasTransform:n===As&&Ls.test(r[Is+"Property"])}}function yr(t,e){for(;t.length<e.length;)t=t.concat(t);return Math.max.apply(null,e.map(function(e,n){return gr(e)+gr(t[n])}))}function gr(t){return 1e3*Number(t.slice(0,-1))}function Er(t,e){var n=t.elm;i(n._leaveCb)&&(n._leaveCb.cancelled=!0,n._leaveCb());var o=dr(t.data.transition);if(!r(o)&&!i(n._enterCb)&&1===n.nodeType){for(var a=o.css,s=o.type,u=o.enterClass,l=o.enterToClass,f=o.enterActiveClass,d=o.appearClass,v=o.appearToClass,m=o.appearActiveClass,h=o.beforeEnter,_=o.enter,y=o.afterEnter,g=o.enterCancelled,E=o.beforeAppear,b=o.appear,C=o.afterAppear,O=o.appearCancelled,w=o.duration,S=pa,M=pa.$vnode;M&&M.parent;)M=M.parent,S=M.context;var I=!S._isMounted||!t.isRootInsert;if(!I||b||""===b){var x=I&&d?d:u,T=I&&m?m:f,D=I&&v?v:l,$=I?E||h:h,L=I&&"function"==typeof b?b:_,k=I?C||y:y,R=I?O||g:g,N=p(c(w)?w.enter:w),P=!1!==a&&!Do,j=Or(L),F=n._enterCb=A(function(){P&&(mr(n,D),mr(n,T)),F.cancelled?(P&&mr(n,x),R&&R(n)):k&&k(n),n._enterCb=null});t.data.show||pt(t,"insert",function(){var e=n.parentNode,r=e&&e._pending&&e._pending[t.key];r&&r.tag===t.tag&&r.elm._leaveCb&&r.elm._leaveCb(),L&&L(n,F)}),$&&$(n),P&&(vr(n,x),vr(n,T),pr(function(){mr(n,x),F.cancelled||(vr(n,D),j||(Cr(N)?setTimeout(F,N):hr(n,s,F)))})),t.data.show&&(e&&e(),L&&L(n,F)),P||j||F()}}}function br(t,e){function n(){O.cancelled||(t.data.show||((o.parentNode._pending||(o.parentNode._pending={}))[t.key]=t),v&&v(o),E&&(vr(o,l),vr(o,d),pr(function(){mr(o,l),O.cancelled||(vr(o,f),b||(Cr(C)?setTimeout(O,C):hr(o,u,O)))})),m&&m(o,O),E||b||O())}var o=t.elm;i(o._enterCb)&&(o._enterCb.cancelled=!0,o._enterCb());var a=dr(t.data.transition);if(r(a)||1!==o.nodeType)return e();if(!i(o._leaveCb)){var s=a.css,u=a.type,l=a.leaveClass,f=a.leaveToClass,d=a.leaveActiveClass,v=a.beforeLeave,m=a.leave,h=a.afterLeave,_=a.leaveCancelled,y=a.delayLeave,g=a.duration,E=!1!==s&&!Do,b=Or(m),C=p(c(g)?g.leave:g),O=o._leaveCb=A(function(){o.parentNode&&o.parentNode._pending&&(o.parentNode._pending[t.key]=null),E&&(mr(o,f),mr(o,d)),O.cancelled?(E&&mr(o,l),_&&_(o)):(e(),h&&h(o)),o._leaveCb=null});y?y(n):n()}}function Cr(t){return"number"==typeof t&&!isNaN(t)}function Or(t){if(r(t))return!1;var e=t.fns;return i(e)?Or(Array.isArray(e)?e[0]:e):(t._length||t.length)>1}function wr(t,e){!0!==e.data.show&&Er(e)}function Sr(t,e,n){Ar(t,e,n),(To||$o)&&setTimeout(function(){Ar(t,e,n)},0)}function Ar(t,e,n){var r=e.value,i=t.multiple;if(!i||Array.isArray(r)){for(var o,a,s=0,c=t.options.length;s<c;s++)if(a=t.options[s],i)o=S(r,Ir(a))>-1,a.selected!==o&&(a.selected=o);else if(w(Ir(a),r))return void(t.selectedIndex!==s&&(t.selectedIndex=s));i||(t.selectedIndex=-1)}}function Mr(t,e){return e.every(function(e){return!w(e,t)})}function Ir(t){return"_value"in t?t._value:t.value}function xr(t){t.target.composing=!0}function Tr(t){t.target.composing&&(t.target.composing=!1,Dr(t.target,"input"))}function Dr(t,e){var n=document.createEvent("HTMLEvents");n.initEvent(e,!0,!0),t.dispatchEvent(n)}function $r(t){return!t.componentInstance||t.data&&t.data.transition?t:$r(t.componentInstance._vnode)}function Lr(t){var e=t&&t.componentOptions;return e&&e.Ctor.options.abstract?Lr(wt(e.children)):t}function kr(t){var e={},n=t.$options;for(var r in n.propsData)e[r]=t[r];var i=n._parentListeners;for(var o in i)e[po(o)]=i[o];return e}function Rr(t,e){if(/\d-keep-alive$/.test(e.tag))return t("keep-alive",{props:e.componentOptions.propsData})}function Nr(t){for(;t=t.parent;)if(t.data.transition)return!0}function Pr(t,e){return e.key===t.key&&e.tag===t.tag}function jr(t){t.elm._moveCb&&t.elm._moveCb(),t.elm._enterCb&&t.elm._enterCb()}function Fr(t){t.data.newPos=t.elm.getBoundingClientRect()}function Hr(t){var e=t.data.pos,n=t.data.newPos,r=e.left-n.left,i=e.top-n.top;if(r||i){t.data.moved=!0;var o=t.elm.style;o.transform=o.WebkitTransform="translate("+r+"px,"+i+"px)",o.transitionDuration="0s"}}function Ur(t,e){var n=e?Ks(e):Js;if(n.test(t)){for(var r,i,o,a=[],s=[],c=n.lastIndex=0;r=n.exec(t);){i=r.index,i>c&&(s.push(o=t.slice(c,i)),a.push(JSON.stringify(o)));var u=Mn(r[1].trim());a.push("_s("+u+")"),s.push({"@binding":u}),c=i+r[0].length}return c<t.length&&(s.push(o=t.slice(c)),a.push(JSON.stringify(o))),{expression:a.join("+"),tokens:s}}}function Br(t,e){var n=(e.warn,Pn(t,"class"));n&&(t.staticClass=JSON.stringify(n));var r=Nn(t,"class",!1);r&&(t.classBinding=r)}function Wr(t){var e="";return t.staticClass&&(e+="staticClass:"+t.staticClass+","),t.classBinding&&(e+="class:"+t.classBinding+","),e}function Gr(t,e){var n=(e.warn,Pn(t,"style"));if(n){t.staticStyle=JSON.stringify(_s(n))}var r=Nn(t,"style",!1);r&&(t.styleBinding=r)}function Vr(t){var e="";return t.staticStyle&&(e+="staticStyle:"+t.staticStyle+","),t.styleBinding&&(e+="style:("+t.styleBinding+"),"),e}function zr(t,e){var n=e?Mc:Ac;return t.replace(n,function(t){return Sc[t]})}function Jr(t,e){function n(e){l+=e,t=t.substring(e)}function r(t,n,r){var i,s;if(null==n&&(n=l),null==r&&(r=l),t&&(s=t.toLowerCase()),t)for(i=a.length-1;i>=0&&a[i].lowerCasedTag!==s;i--);else i=0;if(i>=0){for(var c=a.length-1;c>=i;c--)e.end&&e.end(a[c].tag,n,r);a.length=i,o=i&&a[i-1].tag}else"br"===s?e.start&&e.start(t,[],!0,n,r):"p"===s&&(e.start&&e.start(t,[],!1,n,r),e.end&&e.end(t,n,r))}for(var i,o,a=[],s=e.expectHTML,c=e.isUnaryTag||yo,u=e.canBeLeftOpenTag||yo,l=0;t;){if(i=t,o&&Oc(o)){var f=0,d=o.toLowerCase(),p=wc[d]||(wc[d]=new RegExp("([\\s\\S]*?)(</"+d+"[^>]*>)","i")),v=t.replace(p,function(t,n,r){return f=r.length,Oc(d)||"noscript"===d||(n=n.replace(/<!\--([\s\S]*?)-->/g,"$1").replace(/<!\[CDATA\[([\s\S]*?)]]>/g,"$1")),xc(d,n)&&(n=n.slice(1)),e.chars&&e.chars(n),""});l+=t.length-v.length,t=v,r(d,l-f,l)}else{var m=t.indexOf("<");if(0===m){if(uc.test(t)){var h=t.indexOf("--\x3e");if(h>=0){e.shouldKeepComment&&e.comment(t.substring(4,h)),n(h+3);continue}}if(lc.test(t)){var _=t.indexOf("]>");if(_>=0){n(_+2);continue}}var y=t.match(cc);if(y){n(y[0].length);continue}var g=t.match(sc);if(g){var E=l;n(g[0].length),r(g[1],E,l);continue}var b=function(){var e=t.match(oc);if(e){var r={tagName:e[1],attrs:[],start:l};n(e[0].length);for(var i,o;!(i=t.match(ac))&&(o=t.match(nc));)n(o[0].length),r.attrs.push(o);if(i)return r.unarySlash=i[1],n(i[0].length),r.end=l,r}}();if(b){!function(t){var n=t.tagName,i=t.unarySlash;s&&("p"===o&&ec(n)&&r(o),u(n)&&o===n&&r(n));for(var l=c(n)||!!i,f=t.attrs.length,d=new Array(f),p=0;p<f;p++){var v=t.attrs[p];fc&&-1===v[0].indexOf('""')&&(""===v[3]&&delete v[3],""===v[4]&&delete v[4],""===v[5]&&delete v[5]);var m=v[3]||v[4]||v[5]||"",h="a"===n&&"href"===v[1]?e.shouldDecodeNewlinesForHref:e.shouldDecodeNewlines;d[p]={name:v[1],value:zr(m,h)}}l||(a.push({tag:n,lowerCasedTag:n.toLowerCase(),attrs:d}),o=n),e.start&&e.start(n,d,l,t.start,t.end)}(b),xc(o,t)&&n(1);continue}}var C=void 0,O=void 0,w=void 0;if(m>=0){for(O=t.slice(m);!(sc.test(O)||oc.test(O)||uc.test(O)||lc.test(O)||(w=O.indexOf("<",1))<0);)m+=w,O=t.slice(m);C=t.substring(0,m),n(m)}m<0&&(C=t,t=""),e.chars&&C&&e.chars(C)}if(t===i){e.chars&&e.chars(t);break}}r()}function qr(t,e,n){return{type:1,tag:t,attrsList:e,attrsMap:pi(e),parent:n,children:[]}}function Kr(t,e){function n(t){t.pre&&(s=!1),_c(t.tag)&&(c=!1);for(var n=0;n<hc.length;n++)hc[n](t,e)}dc=e.warn||xn,_c=e.isPreTag||yo,yc=e.mustUseProp||yo,gc=e.getTagNamespace||yo,vc=Tn(e.modules,"transformNode"),mc=Tn(e.modules,"preTransformNode"),hc=Tn(e.modules,"postTransformNode"),pc=e.delimiters;var r,i,o=[],a=!1!==e.preserveWhitespace,s=!1,c=!1;return Jr(t,{warn:dc,expectHTML:e.expectHTML,isUnaryTag:e.isUnaryTag,canBeLeftOpenTag:e.canBeLeftOpenTag,shouldDecodeNewlines:e.shouldDecodeNewlines,shouldDecodeNewlinesForHref:e.shouldDecodeNewlinesForHref,shouldKeepComment:e.comments,start:function(t,a,u){var l=i&&i.ns||gc(t);To&&"svg"===l&&(a=hi(a));var f=qr(t,a,i);l&&(f.ns=l),mi(f)&&!Fo()&&(f.forbidden=!0);for(var d=0;d<mc.length;d++)f=mc[d](f,e)||f;if(s||(Yr(f),f.pre&&(s=!0)),_c(f.tag)&&(c=!0),s?Zr(f):f.processed||(ei(f),ri(f),si(f),Xr(f,e)),r?o.length||r.if&&(f.elseif||f.else)&&ai(r,{exp:f.elseif,block:f}):r=f,i&&!f.forbidden)if(f.elseif||f.else)ii(f,i);else if(f.slotScope){i.plain=!1;var p=f.slotTarget||'"default"';(i.scopedSlots||(i.scopedSlots={}))[p]=f}else i.children.push(f),f.parent=i;u?n(f):(i=f,o.push(f))},end:function(){var t=o[o.length-1],e=t.children[t.children.length-1];e&&3===e.type&&" "===e.text&&!c&&t.children.pop(),o.length-=1,i=o[o.length-1],n(t)},chars:function(t){if(i&&(!To||"textarea"!==i.tag||i.attrsMap.placeholder!==t)){var e=i.children;if(t=c||t.trim()?vi(i)?t:jc(t):a&&e.length?" ":""){var n;!s&&" "!==t&&(n=Ur(t,pc))?e.push({type:2,expression:n.expression,tokens:n.tokens,text:t}):" "===t&&e.length&&" "===e[e.length-1].text||e.push({type:3,text:t})}}},comment:function(t){i.children.push({type:3,text:t,isComment:!0})}}),r}function Yr(t){null!=Pn(t,"v-pre")&&(t.pre=!0)}function Zr(t){var e=t.attrsList.length;if(e)for(var n=t.attrs=new Array(e),r=0;r<e;r++)n[r]={name:t.attrsList[r].name,value:JSON.stringify(t.attrsList[r].value)};else t.pre||(t.plain=!0)}function Xr(t,e){Qr(t),t.plain=!t.key&&!t.attrsList.length,ti(t),ci(t),ui(t);for(var n=0;n<vc.length;n++)t=vc[n](t,e)||t;li(t)}function Qr(t){var e=Nn(t,"key");e&&(t.key=e)}function ti(t){var e=Nn(t,"ref");e&&(t.ref=e,t.refInFor=fi(t))}function ei(t){var e;if(e=Pn(t,"v-for")){var n=ni(e);n&&b(t,n)}}function ni(t){var e=t.match($c);if(e){var n={};n.for=e[2].trim();var r=e[1].trim().replace(kc,""),i=r.match(Lc);return i?(n.alias=r.replace(Lc,""),n.iterator1=i[1].trim(),i[2]&&(n.iterator2=i[2].trim())):n.alias=r,n}}function ri(t){var e=Pn(t,"v-if");if(e)t.if=e,ai(t,{exp:e,block:t});else{null!=Pn(t,"v-else")&&(t.else=!0);var n=Pn(t,"v-else-if");n&&(t.elseif=n)}}function ii(t,e){var n=oi(e.children);n&&n.if&&ai(n,{exp:t.elseif,block:t})}function oi(t){for(var e=t.length;e--;){if(1===t[e].type)return t[e];t.pop()}}function ai(t,e){t.ifConditions||(t.ifConditions=[]),t.ifConditions.push(e)}function si(t){null!=Pn(t,"v-once")&&(t.once=!0)}function ci(t){if("slot"===t.tag)t.slotName=Nn(t,"name");else{var e;"template"===t.tag?(e=Pn(t,"scope"),t.slotScope=e||Pn(t,"slot-scope")):(e=Pn(t,"slot-scope"))&&(t.slotScope=e);var n=Nn(t,"slot");n&&(t.slotTarget='""'===n?'"default"':n,"template"===t.tag||t.slotScope||$n(t,"slot",n))}}function ui(t){var e;(e=Nn(t,"is"))&&(t.component=e),null!=Pn(t,"inline-template")&&(t.inlineTemplate=!0)}function li(t){var e,n,r,i,o,a,s,c=t.attrsList;for(e=0,n=c.length;e<n;e++)if(r=i=c[e].name,o=c[e].value,Dc.test(r))if(t.hasBindings=!0,a=di(r),a&&(r=r.replace(Pc,"")),Nc.test(r))r=r.replace(Nc,""),o=Mn(o),s=!1,a&&(a.prop&&(s=!0,"innerHtml"===(r=po(r))&&(r="innerHTML")),a.camel&&(r=po(r)),a.sync&&Rn(t,"update:"+po(r),Fn(o,"$event"))),s||!t.component&&yc(t.tag,t.attrsMap.type,r)?Dn(t,r,o):$n(t,r,o);else if(Tc.test(r))r=r.replace(Tc,""),Rn(t,r,o,a,!1,dc);else{r=r.replace(Dc,"");var u=r.match(Rc),l=u&&u[1];l&&(r=r.slice(0,-(l.length+1))),kn(t,r,i,o,l,a)}else{$n(t,r,JSON.stringify(o)),!t.component&&"muted"===r&&yc(t.tag,t.attrsMap.type,r)&&Dn(t,r,"true")}}function fi(t){for(var e=t;e;){if(void 0!==e.for)return!0;e=e.parent}return!1}function di(t){var e=t.match(Pc);if(e){var n={};return e.forEach(function(t){n[t.slice(1)]=!0}),n}}function pi(t){for(var e={},n=0,r=t.length;n<r;n++)e[t[n].name]=t[n].value;return e}function vi(t){return"script"===t.tag||"style"===t.tag}function mi(t){return"style"===t.tag||"script"===t.tag&&(!t.attrsMap.type||"text/javascript"===t.attrsMap.type)}function hi(t){for(var e=[],n=0;n<t.length;n++){var r=t[n];Fc.test(r.name)||(r.name=r.name.replace(Hc,""),e.push(r))}return e}function _i(t,e){if("input"===t.tag){var n=t.attrsMap;if(!n["v-model"])return;var r;if((n[":type"]||n["v-bind:type"])&&(r=Nn(t,"type")),n.type||r||!n["v-bind"]||(r="("+n["v-bind"]+").type"),r){var i=Pn(t,"v-if",!0),o=i?"&&("+i+")":"",a=null!=Pn(t,"v-else",!0),s=Pn(t,"v-else-if",!0),c=yi(t);ei(c),Ln(c,"type","checkbox"),Xr(c,e),c.processed=!0,c.if="("+r+")==='checkbox'"+o,ai(c,{exp:c.if,block:c});var u=yi(t);Pn(u,"v-for",!0),Ln(u,"type","radio"),Xr(u,e),ai(c,{exp:"("+r+")==='radio'"+o,block:u});var l=yi(t);return Pn(l,"v-for",!0),Ln(l,":type",r),Xr(l,e),ai(c,{exp:i,block:l}),a?c.else=!0:s&&(c.elseif=s),c}}}function yi(t){return qr(t.tag,t.attrsList.slice(),t.parent)}function gi(t,e){e.value&&Dn(t,"textContent","_s("+e.value+")")}function Ei(t,e){e.value&&Dn(t,"innerHTML","_s("+e.value+")")}function bi(t,e){t&&(Ec=Vc(e.staticKeys||""),bc=e.isReservedTag||yo,Oi(t),wi(t,!1))}function Ci(t){return v("type,tag,attrsList,attrsMap,plain,parent,children,attrs"+(t?","+t:""))}function Oi(t){if(t.static=Si(t),1===t.type){if(!bc(t.tag)&&"slot"!==t.tag&&null==t.attrsMap["inline-template"])return;for(var e=0,n=t.children.length;e<n;e++){var r=t.children[e];Oi(r),r.static||(t.static=!1)}if(t.ifConditions)for(var i=1,o=t.ifConditions.length;i<o;i++){var a=t.ifConditions[i].block;Oi(a),a.static||(t.static=!1)}}}function wi(t,e){if(1===t.type){if((t.static||t.once)&&(t.staticInFor=e),t.static&&t.children.length&&(1!==t.children.length||3!==t.children[0].type))return void(t.staticRoot=!0);if(t.staticRoot=!1,t.children)for(var n=0,r=t.children.length;n<r;n++)wi(t.children[n],e||!!t.for);if(t.ifConditions)for(var i=1,o=t.ifConditions.length;i<o;i++)wi(t.ifConditions[i].block,e)}}function Si(t){return 2!==t.type&&(3===t.type||!(!t.pre&&(t.hasBindings||t.if||t.for||co(t.tag)||!bc(t.tag)||Ai(t)||!Object.keys(t).every(Ec))))}function Ai(t){for(;t.parent;){if(t=t.parent,"template"!==t.tag)return!1;if(t.for)return!0}return!1}function Mi(t,e,n){var r=e?"nativeOn:{":"on:{";for(var i in t)r+='"'+i+'":'+Ii(i,t[i])+",";return r.slice(0,-1)+"}"}function Ii(t,e){if(!e)return"function(){}";if(Array.isArray(e))return"["+e.map(function(e){return Ii(t,e)}).join(",")+"]";var n=Jc.test(e.value),r=zc.test(e.value);if(e.modifiers){var i="",o="",a=[];for(var s in e.modifiers)if(Zc[s])o+=Zc[s],qc[s]&&a.push(s);else if("exact"===s){var c=e.modifiers;o+=Yc(["ctrl","shift","alt","meta"].filter(function(t){return!c[t]}).map(function(t){return"$event."+t+"Key"}).join("||"))}else a.push(s);a.length&&(i+=xi(a)),o&&(i+=o);return"function($event){"+i+(n?"return "+e.value+"($event)":r?"return ("+e.value+")($event)":e.value)+"}"}return n||r?e.value:"function($event){"+e.value+"}"}function xi(t){return"if(!('button' in $event)&&"+t.map(Ti).join("&&")+")return null;"}function Ti(t){var e=parseInt(t,10);if(e)return"$event.keyCode!=="+e;var n=qc[t],r=Kc[t];return"_k($event.keyCode,"+JSON.stringify(t)+","+JSON.stringify(n)+",$event.key,"+JSON.stringify(r)+")"}function Di(t,e){t.wrapListeners=function(t){return"_g("+t+","+e.value+")"}}function $i(t,e){t.wrapData=function(n){return"_b("+n+",'"+t.tag+"',"+e.value+","+(e.modifiers&&e.modifiers.prop?"true":"false")+(e.modifiers&&e.modifiers.sync?",true":"")+")"}}function Li(t,e){var n=new Qc(e);return{render:"with(this){return "+(t?ki(t,n):'_c("div")')+"}",staticRenderFns:n.staticRenderFns}}function ki(t,e){if(t.staticRoot&&!t.staticProcessed)return Ri(t,e);if(t.once&&!t.onceProcessed)return Ni(t,e);if(t.for&&!t.forProcessed)return Fi(t,e);if(t.if&&!t.ifProcessed)return Pi(t,e);if("template"!==t.tag||t.slotTarget){if("slot"===t.tag)return Xi(t,e);var n;if(t.component)n=Qi(t.component,t,e);else{var r=t.plain?void 0:Hi(t,e),i=t.inlineTemplate?null:zi(t,e,!0);n="_c('"+t.tag+"'"+(r?","+r:"")+(i?","+i:"")+")"}for(var o=0;o<e.transforms.length;o++)n=e.transforms[o](t,n);return n}return zi(t,e)||"void 0"}function Ri(t,e){return t.staticProcessed=!0,e.staticRenderFns.push("with(this){return "+ki(t,e)+"}"),"_m("+(e.staticRenderFns.length-1)+(t.staticInFor?",true":"")+")"}function Ni(t,e){if(t.onceProcessed=!0,t.if&&!t.ifProcessed)return Pi(t,e);if(t.staticInFor){for(var n="",r=t.parent;r;){if(r.for){n=r.key;break}r=r.parent}return n?"_o("+ki(t,e)+","+e.onceId+++","+n+")":ki(t,e)}return Ri(t,e)}function Pi(t,e,n,r){return t.ifProcessed=!0,ji(t.ifConditions.slice(),e,n,r)}function ji(t,e,n,r){function i(t){return n?n(t,e):t.once?Ni(t,e):ki(t,e)}if(!t.length)return r||"_e()";var o=t.shift();return o.exp?"("+o.exp+")?"+i(o.block)+":"+ji(t,e,n,r):""+i(o.block)}function Fi(t,e,n,r){var i=t.for,o=t.alias,a=t.iterator1?","+t.iterator1:"",s=t.iterator2?","+t.iterator2:"";return t.forProcessed=!0,(r||"_l")+"(("+i+"),function("+o+a+s+"){return "+(n||ki)(t,e)+"})"}function Hi(t,e){var n="{",r=Ui(t,e);r&&(n+=r+","),t.key&&(n+="key:"+t.key+","),t.ref&&(n+="ref:"+t.ref+","),t.refInFor&&(n+="refInFor:true,"),t.pre&&(n+="pre:true,"),t.component&&(n+='tag:"'+t.tag+'",');for(var i=0;i<e.dataGenFns.length;i++)n+=e.dataGenFns[i](t);if(t.attrs&&(n+="attrs:{"+to(t.attrs)+"},"),t.props&&(n+="domProps:{"+to(t.props)+"},"),t.events&&(n+=Mi(t.events,!1,e.warn)+","),t.nativeEvents&&(n+=Mi(t.nativeEvents,!0,e.warn)+","),t.slotTarget&&!t.slotScope&&(n+="slot:"+t.slotTarget+","),t.scopedSlots&&(n+=Wi(t.scopedSlots,e)+","),t.model&&(n+="model:{value:"+t.model.value+",callback:"+t.model.callback+",expression:"+t.model.expression+"},"),t.inlineTemplate){var o=Bi(t,e);o&&(n+=o+",")}return n=n.replace(/,$/,"")+"}",t.wrapData&&(n=t.wrapData(n)),t.wrapListeners&&(n=t.wrapListeners(n)),n}function Ui(t,e){var n=t.directives;if(n){var r,i,o,a,s="directives:[",c=!1;for(r=0,i=n.length;r<i;r++){o=n[r],a=!0;var u=e.directives[o.name];u&&(a=!!u(t,o,e.warn)),a&&(c=!0,s+='{name:"'+o.name+'",rawName:"'+o.rawName+'"'+(o.value?",value:("+o.value+"),expression:"+JSON.stringify(o.value):"")+(o.arg?',arg:"'+o.arg+'"':"")+(o.modifiers?",modifiers:"+JSON.stringify(o.modifiers):"")+"},")}return c?s.slice(0,-1)+"]":void 0}}function Bi(t,e){var n=t.children[0];if(1===n.type){var r=Li(n,e.options);return"inlineTemplate:{render:function(){"+r.render+"},staticRenderFns:["+r.staticRenderFns.map(function(t){return"function(){"+t+"}"}).join(",")+"]}"}}function Wi(t,e){return"scopedSlots:_u(["+Object.keys(t).map(function(n){return Gi(n,t[n],e)}).join(",")+"])"}function Gi(t,e,n){return e.for&&!e.forProcessed?Vi(t,e,n):"{key:"+t+",fn:function("+String(e.slotScope)+"){return "+("template"===e.tag?e.if?e.if+"?"+(zi(e,n)||"undefined")+":undefined":zi(e,n)||"undefined":ki(e,n))+"}}"}function Vi(t,e,n){var r=e.for,i=e.alias,o=e.iterator1?","+e.iterator1:"",a=e.iterator2?","+e.iterator2:"";return e.forProcessed=!0,"_l(("+r+"),function("+i+o+a+"){return "+Gi(t,e,n)+"})"}function zi(t,e,n,r,i){var o=t.children;if(o.length){var a=o[0];if(1===o.length&&a.for&&"template"!==a.tag&&"slot"!==a.tag)return(r||ki)(a,e);var s=n?Ji(o,e.maybeComponent):0,c=i||Ki;return"["+o.map(function(t){return c(t,e)}).join(",")+"]"+(s?","+s:"")}}function Ji(t,e){for(var n=0,r=0;r<t.length;r++){var i=t[r];if(1===i.type){if(qi(i)||i.ifConditions&&i.ifConditions.some(function(t){return qi(t.block)})){n=2;break}(e(i)||i.ifConditions&&i.ifConditions.some(function(t){return e(t.block)}))&&(n=1)}}return n}function qi(t){return void 0!==t.for||"template"===t.tag||"slot"===t.tag}function Ki(t,e){return 1===t.type?ki(t,e):3===t.type&&t.isComment?Zi(t):Yi(t)}function Yi(t){return"_v("+(2===t.type?t.expression:eo(JSON.stringify(t.text)))+")"}function Zi(t){return"_e("+JSON.stringify(t.text)+")"}function Xi(t,e){var n=t.slotName||'"default"',r=zi(t,e),i="_t("+n+(r?","+r:""),o=t.attrs&&"{"+t.attrs.map(function(t){return po(t.name)+":"+t.value}).join(",")+"}",a=t.attrsMap["v-bind"];return!o&&!a||r||(i+=",null"),o&&(i+=","+o),a&&(i+=(o?"":",null")+","+a),i+")"}function Qi(t,e,n){var r=e.inlineTemplate?null:zi(e,n,!0);return"_c("+t+","+Hi(e,n)+(r?","+r:"")+")"}function to(t){for(var e="",n=0;n<t.length;n++){var r=t[n];e+='"'+r.name+'":'+eo(r.value)+","}return e.slice(0,-1)}function eo(t){return t.replace(/\u2028/g,"\\u2028").replace(/\u2029/g,"\\u2029")}function no(t,e){try{return new Function(t)}catch(n){return e.push({err:n,code:t}),O}}function ro(t){var e=Object.create(null);return function(n,r,i){r=b({},r);r.warn;delete r.warn;var o=r.delimiters?String(r.delimiters)+n:n;if(e[o])return e[o];var a=t(n,r),s={},c=[];return s.render=no(a.render,c),s.staticRenderFns=a.staticRenderFns.map(function(t){return no(t,c)}),e[o]=s}}function io(t){return Cc=Cc||document.createElement("div"),Cc.innerHTML=t?'<a href="\n"/>':'<div a="\n"/>',Cc.innerHTML.indexOf("&#10;")>0}function oo(t){if(t.outerHTML)return t.outerHTML;var e=document.createElement("div");return e.appendChild(t.cloneNode(!0)),e.innerHTML}/*!
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L49

Insecure DOM Manipulation (XSS) in admin-module-edit.js

CWE-79
File Location: media/com_modules/js/admin-module-edit.js:49
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- tmpMenu.innerHTML = '<span class=\"badge badge-danger\">' + Joomla.JText._('JNO') + '</span>';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L97

Insecure DOM Manipulation (XSS) in admin-module-edit.js

CWE-79
File Location: media/com_modules/js/admin-module-edit.js:97
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- jQuery('#access-' + options.itemId, parent.document).innerHTML = parent.viewLevels[updAccess];
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L71

Insecure DOM Manipulation (XSS) in html5.js

CWE-79
File Location: media/legacy/js/html5.js:71
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- p.innerHTML = 'x<style>' + cssText + '</style>';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L68

Insecure DOM Manipulation (XSS) in extensionupdatecheck.js

CWE-79
File Location: media/plg_quickicon_extensionupdate/js/extensionupdatecheck.js:68
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- linkSpan[i].innerHTML = Joomla.JText._('PLG_QUICKICON_EXTENSIONUPDATE_ERROR');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L929

Insecure DOM Manipulation (XSS) in calendar.js

CWE-79
File Location: media/system/js/fields/calendar.js:929
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- cell.innerHTML = this.params.debug ? iday : Date.convertNumbers(iday); // translated day number for each cell
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L89

Insecure DOM Manipulation (XSS) in passwordstrength.js

CWE-79
File Location: media/system/js/fields/passwordstrength.js:89
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- label.innerHTML = Joomla.JText._('JFIELD_PASSWORD_INDICATE_COMPLETE');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L101

Insecure DOM Manipulation (XSS) in passwordstrength.js

CWE-79
File Location: media/system/js/fields/passwordstrength.js:101
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- label.innerHTML = Joomla.JText._('JFIELD_PASSWORD_INDICATE_INCOMPLETE');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L90

Insecure DOM Manipulation (XSS) in validate.js

CWE-79
File Location: media/system/js/fields/validate.js:90
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- elMsg.innerHTML = message ? message : Joomla.JText._('JLIB_FORM_FIELD_REQUIRED_CHECK');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in searchtools.min.js

CWE-79
File Location: media/system/js/searchtools.min.js:1
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- !function(){"use strict";var t=function(t,e){this.element=t,this.options=Joomla.extend({formSelector:".js-stools-form",searchFieldSelector:".js-stools-field-search",clearBtnSelector:".js-stools-btn-clear",mainContainerSelector:".js-stools",searchBtnSelector:".js-stools-btn-search",filterBtnSelector:".js-stools-btn-filter",filterContainerSelector:".js-stools-container-filters",filtersHidden:!0,listBtnSelector:".js-stools-btn-list",listContainerSelector:".js-stools-container-list",listHidden:!0,orderColumnSelector:".js-stools-column-order",orderBtnSelector:".js-stools-btn-order",orderFieldSelector:".js-stools-field-order",orderFieldName:"list[fullordering]",limitFieldSelector:".js-stools-field-limit",defaultLimit:20,activeOrder:null,activeDirection:"ASC",clearListOptions:!1},e),this.theForm=document.querySelector(this.options.formSelector),this.filterButton=document.querySelector(this.options.formSelector+" "+this.options.filterBtnSelector),this.filterContainer=document.querySelector(this.options.formSelector+" "+this.options.filterContainerSelector)?document.querySelector(this.options.formSelector+" "+this.options.filterContainerSelector):"",this.filtersHidden=this.options.filtersHidden,this.listButton=document.querySelector(this.options.listBtnSelector),this.listContainer=document.querySelector(this.options.formSelector+" "+this.options.listContainerSelector),this.listHidden=this.options.listHidden,this.mainContainer=document.querySelector(this.options.mainContainerSelector),this.searchButton=document.querySelector(this.options.formSelector+" "+this.options.searchBtnSelector),this.searchField=document.querySelector(this.options.formSelector+" "+this.options.searchFieldSelector),this.searchString=null,this.clearButton=document.querySelector(this.options.clearBtnSelector),this.orderCols=Array.prototype.slice.call(document.querySelectorAll(this.options.formSelector+" "+this.options.orderColumnSelector)),this.orderField=document.querySelector(this.options.formSelector+" "+this.options.orderFieldSelector),this.limitField=document.querySelector(this.options.formSelector+" "+this.options.limitFieldSelector),this.activeColumn=null,this.activeDirection=this.options.activeDirection,this.activeOrder=this.options.activeOrder,this.activeLimit=null,this.clearListOptions=this.options.clearListOptions,this.init()};t.prototype={init:function(){var t=this;document.addEventListener||this.searchField.value===this.searchField.getAttribute("placeholder")&&(this.searchField.value=""),this.searchString=this.searchField.value,this.filterContainer&&this.filterContainer.classList.contains("js-stools-container-filters-visible")?(this.showFilters(),this.showList()):(this.hideFilters(),this.hideList()),t.filterButton&&t.filterButton.addEventListener("click",function(e){t.toggleFilters(),e.stopPropagation(),e.preventDefault()}),t.listButton&&t.listButton.addEventListener("click",function(e){t.toggleList(),e.stopPropagation(),e.preventDefault()}),t.getFilterFields()&&t.getFilterFields().forEach(function(e){t.checkFilter(e),e.addEventListener("change",function(){t.checkFilter(e)})}),t.clearButton&&t.clearButton.addEventListener("click",function(){t.clear()}),this.createOrderField(),t.orderCols.forEach(function(e){e.addEventListener("click",function(){var e=this.getAttribute("data-order"),i=this.getAttribute("data-direction"),r=e+" "+i;e.length&&(t.activeColumn=e,r!==t.activeOrder?(t.activeDirection=i,t.activeOrder=r,t.updateFieldValue(t.orderField,r)):t.toggleDirection(),t.theForm.submit())})}),t.checkActiveStatus(t),document.body.addEventListener("click",function(e){document.body.classList.contains("filters-shown")&&t.hideFilters()}),t.filterContainer.addEventListener("click",function(t){t.stopPropagation()},!0)},checkFilter:function(t){var e=t.querySelector("option:checked");e&&(""!==e.value?this.activeFilter(t,this):this.deactiveFilter(t,this))},clear:function(){var t=this;t.searchField&&(t.searchField.value=""),t.getFilterFields()&&t.getFilterFields().forEach(function(e){e.value="",t.checkFilter(e),window.jQuery&&jQuery.chosen&&jQuery(e).trigger("liszt:updated")}),t.clearListOptions&&(t.getListFields().forEach(function(e){e.value="",t.checkFilter(e),window.jQuery&&jQuery.chosen&&jQuery(e).trigger("liszt:updated")}),document.querySelector("#list_limit").value=t.options.defaultLimit,window.jQuery&&jQuery.chosen&&jQuery("#list_limit").trigger("liszt:updated")),t.theForm.submit()},checkActiveStatus:function(t){var e=t.mainContainer;[].slice.call(e.querySelectorAll(".js-stools-field-filter select")).forEach(function(e){if(e.classList.contains("active"))return t.filterButton.classList.remove("btn-secondary"),t.filterButton.classList.add("btn-primary"),""})},activeFilter:function(t,e){t.classList.add("active");var i="#"+t.getAttribute("id"),r=t.querySelector(i);r&&r.classList.add("active")},deactiveFilter:function(t,e){t.classList.remove("active");var i="#"+t.getAttribute("id"),r=t.querySelector(i);r&&r.classList.remove("active")},getFilterFields:function(){if(this.filterContainer)return Array.prototype.slice.call(this.filterContainer.querySelectorAll("select,input"))},getListFields:function(){return Array.prototype.slice.call(this.listContainer.querySelectorAll("select"))},hideContainer:function(t){t&&(t.classList.remove("js-filters-show"),document.body.classList.remove("filters-shown"))},showContainer:function(t){t.classList.add("js-filters-show"),document.body.classList.add("filters-shown")},toggleContainer:function(t){t.classList.contains("js-filters-show")?this.hideContainer(t):this.showContainer(t)},hideList:function(){this.hideContainer(this.filterContainer)},showList:function(){this.showContainer(this.filterContainer)},toggleList:function(){this.toggleContainer(this.filterContainer)},hideFilters:function(){this.hideContainer(this.filterContainer)},showFilters:function(){this.showContainer(this.filterContainer)},toggleFilters:function(){this.toggleContainer(this.filterContainer)},toggleDirection:function(){var t="ASC";"ASC"==this.activeDirection.toUpperCase()&&(t="DESC"),this.activeDirection=t,this.activeOrder=this.activeColumn+" "+t,this.updateFieldValue(this.orderField,this.activeOrder)},createOrderField:function(){if(this.orderField||(this.orderField=document.createElement("input"),this.orderField.setAttribute("type","hidden"),this.orderField.setAttribute("id","js-stools-field-order"),this.orderField.setAttribute("class","js-stools-field-order"),this.orderField.setAttribute("name",this.options.orderFieldName),this.orderField.setAttribute("value",this.activeOrder+" "+this.activeDirection),this.theForm.innerHTML+=this.orderField.outerHTML),"select"==this.orderField.tagName.toLowerCase()){for(var t=this.orderField.options,e=0,i=t.length;i>e;e++){var r,o=t[e].getAttribute("data-order"),s=t[e].getAttribute("data-name"),n=t[e].getAttribute("data-direction");if(o&&o.length)if(o=o+" "+n,!(r=this.findOption(this.orderField,o)).length)(r=document.createElement("option")).text=s,r.value=o,t[e].classList.contains("active")&&r.setAttribute("selected","selected"),this.orderFieldName.innerHTML+=r}window.jQuery&&jQuery.chosen&&jQuery(this.orderField).trigger("liszt:updated")}this.activeOrder=this.orderField.value},updateFieldValue:function(t,e){var i=t.getAttribute("type");if("hidden"===i||"text"===i)t.setAttribute("value",e);else if("select"===t.tagName.toLowerCase()){for(var r=t.options,o=0,s=r.length;s>o;o++)if(r[o].value==e)var n=r[o];if(n&&n.length)n.setAttribute("selected","selected");else{var l=document.createElement("option");l.text=name,l.value=e,l.setAttribute("selected","selected"),t.appendChild(l)}t.value=e,window.jQuery&&jQuery.chosen&&t.trigger("liszt:updated")}},findOption:function(t,e){for(var i=0,r=t.length;r>i;i++)if(t[i].value==e)return t[i]}},document.addEventListener("DOMContentLoaded",function(){if(Joomla.getOptions("searchtools")){var e=Joomla.getOptions("searchtools"),i=document.querySelector(e.selector);new t(i,e)}})}();
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L72

Insecure DOM Manipulation (XSS) in joomla-field-module-order.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-module-order.js:72
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- node.innerHTML = item[2];
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L82

Insecure DOM Manipulation (XSS) in joomla-field-module-order.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-module-order.js:82
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- this.innerHTML = '';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L133

Insecure DOM Manipulation (XSS) in joomla-field-permissions-es5.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-permissions-es5.js:133
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- badgeSpan.innerHTML = response.data.text;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L112

Insecure DOM Manipulation (XSS) in joomla-field-permissions.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-permissions.js:112
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- badgeSpan.innerHTML = response.data.text;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L178

Insecure DOM Manipulation (XSS) in field-subform.js

CWE-79
File Location: build/media/webcomponents/js/field-subform/field-subform.js:178
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- tmpEl.innerHTML = this.template;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L89

Insecure DOM Manipulation (XSS) in field-user.js

CWE-79
File Location: build/media/webcomponents/js/field-user/field-user.js:89
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- this.modalBody.innerHTML = '';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L239

Insecure DOM Manipulation (XSS) in tab.js

CWE-79
File Location: build/media/webcomponents/js/tab/tab.js:239
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- aElement.innerHTML = tab.getAttribute('name');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L45

Insecure DOM Manipulation (XSS) in associations-edit.js

CWE-79
File Location: media/com_associations/js/associations-edit.js:45
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- html.innerHTML = Joomla.JText._('JGLOBAL_ASSOC_NOT_POSSIBLE');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L95

Insecure DOM Manipulation (XSS) in indexer.js

CWE-79
File Location: media/com_finder/js/indexer.js:95
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- progressMessage.innerHTML = error;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L199

Insecure DOM Manipulation (XSS) in overrider.js

CWE-79
File Location: media/com_languages/js/overrider.js:199
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- key.innerHTML = item.constant;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L211

Insecure DOM Manipulation (XSS) in edit-images.js

CWE-79
File Location: media/com_media/js/edit-images.js:211
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- document.getElementById('media-manager-edit-container').innerHTML = '';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L45

Insecure DOM Manipulation (XSS) in admin-module-edit.js

CWE-79
File Location: media/com_modules/js/admin-module-edit.js:45
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- tmpMenu.innerHTML = '<span class=\"badge badge-info\">' + Joomla.JText._('JALL') + '</span>';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in stats-message.es6.min.js

CWE-79
File Location: media/plg_system_stats/js/stats-message.es6.min.js:1
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- Joomla=window.Joomla||{},((e,t)=>{"use strict";const s=({plugin:n="sendStats"}={})=>{const a=`index.php?option=com_ajax&group=system&plugin=${n}&format=raw`,l=t.getElementById("system-message-container");e.request({url:a,headers:{"Content-Type":"application/json"},onSuccess:e=>{try{const n=JSON.parse(e);n&&n.html&&(l.innerHTML=n.html,l.querySelector(".js-pstats-alert").style.display="block",(e=>{const s=t.getElementById("system-message-container"),n=s.querySelector(".js-pstats-alert"),a=s.querySelector(".js-pstats-data-details");t.addEventListener("click",e=>{e.target.classList.contains("js-pstats-btn-details")&&(e.preventDefault(),a.classList.toggle("d-none"))}),t.addEventListener("click",t=>{t.target.classList.contains("js-pstats-btn-allow-always")&&(t.preventDefault(),n.close(),e({plugin:"sendAlways"}))}),t.addEventListener("click",t=>{t.target.classList.contains("js-pstats-btn-allow-once")&&(t.preventDefault(),n.close(),e({plugin:"sendOnce"}))}),t.addEventListener("click",t=>{t.target.classList.contains("js-pstats-btn-allow-never")&&(t.preventDefault(),n.close(),e({plugin:"sendNever"}))})})(s))}catch(e){throw new Error(e)}},onError:t=>{e.renderMessages({error:[t.response]})}})};t.addEventListener("DOMContentLoaded",()=>{s()})})(Joomla,document);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L453

Insecure DOM Manipulation (XSS) in core.js

CWE-79
File Location: media/system/js/core.js:453
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- messageWrapper.innerHTML = typeMessages[ i ];
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in core.min.js

CWE-79
File Location: media/system/js/core.min.js:1
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- Joomla=window.Joomla||{},Joomla.editors=Joomla.editors||{},Joomla.editors.instances=Joomla.editors.instances||{},Joomla.Modal={current:"",setCurrent:function(e){this.current=e},getCurrent:function(){return this.current}},function(e,t){"use strict";e.submitform=function(e,n,o){n||(n=t.getElementById("adminForm")),e&&(n.task.value=e),n.noValidate=!o,o?n.hasAttribute("novalidate")&&n.removeAttribute("novalidate"):n.setAttribute("novalidate","");var r=t.createElement("input");r.style.display="none",r.type="submit",n.appendChild(r).click(),n.removeChild(r)},e.submitbutton=function(n,o,r){var s=t.querySelector(o||"form.form-validate");if(s){if(void 0===r||null===r){var i=n.split("."),a=s.getAttribute("data-cancel-task");a||(a=i[0]+".cancel"),r=n!==a}r&&!t.formvalidator.isValid(s)||e.submitform(n,s)}else e.submitform(n)},e.JText={strings:{},_:function(t,n){var o=e.getOptions("joomla.jtext");return o&&(this.load(o),e.loadOptions({"joomla.jtext":null})),n=void 0===n?"":n,t=t.toUpperCase(),void 0!==this.strings[t]?this.strings[t]:n},load:function(e){for(var t in e)e.hasOwnProperty(t)&&(this.strings[t.toUpperCase()]=e[t]);return this}},e.optionsStorage=e.optionsStorage||null,e.getOptions=function(t,n){return e.optionsStorage||e.loadOptions(),void 0!==e.optionsStorage[t]?e.optionsStorage[t]:n},e.loadOptions=function(n){if(!n){for(var o,r,s,i=t.querySelectorAll(".joomla-script-options.new"),a=0,l=0,c=i.length;l<c;l++)o=(r=i[l]).text||r.textContent,(s=JSON.parse(o))&&(e.loadOptions(s),a++),r.className=r.className.replace(" new"," loaded");if(a)return}if(e.optionsStorage){if(n)for(var d in n)n.hasOwnProperty(d)&&(null!==n[d]&&"object"==typeof e.optionsStorage[d]&&"object"==typeof n[d]?e.optionsStorage[d]=e.extend(e.optionsStorage[d],n[d]):e.optionsStorage[d]=n[d])}else e.optionsStorage=n||{}},e.replaceTokens=function(e){if(/^[0-9A-F]{32}$/i.test(e)){var n,o,r,s=t.getElementsByTagName("input");for(n=0,r=s.length;n<r;n++)"hidden"==(o=s[n]).type&&"1"==o.value&&32==o.name.length&&(o.name=e)}},e.isEmail=function(e){return/^[\w.!#$%&‚Äô*+\/=?^`{|}~-]+@[a-z0-9-]+(?:\.[a-z0-9-]{2,})+$/i.test(e)},e.checkAll=function(t,n){if(!t.form)return!1;n=n||"cb";var o,r,s,i=0;for(o=0,s=t.form.elements.length;o<s;o++)(r=t.form.elements[o]).type==t.type&&0===r.id.indexOf(n)&&(r.checked=t.checked,i+=r.checked?1:0);return t.form.boxchecked&&(t.form.boxchecked.value=i,e.Event.dispatch(t.form.boxchecked,"change")),!0},e.renderMessages=function(n,o,r,s){var i,a,l,c,d,m,u,f;for(a in i=void 0===o||o&&"#system-message-container"===o?t.getElementById("system-message-container"):t.querySelector(o),(void 0===r||r&&!1===r)&&e.removeMessages(i),n)if(n.hasOwnProperty(a)){if(l=n[a],"object"==typeof window.customElements&&"function"==typeof window.customElements.get("joomla-alert"))c=t.createElement("joomla-alert"),["notice","message","error"].indexOf(a)>-1?(f="notice"===a?"info":a,f="message"===a?"success":f,f="error"===a?"danger":f):f="info",c.setAttribute("type",f),c.setAttribute("dismiss","true"),s&&parseInt(s)>0&&c.setAttribute("autodismiss",s);else{c=t.createElement("div"),["notice","message","error"].indexOf(a)>-1?(f="notice"===a?"info":a,f="message"===a?"success":f,f="error"===a?"danger":f):f="info",c.className="alert "+f;var p=t.createElement("button");p.setAttribute("type","button"),p.setAttribute("data-dismiss","alert"),p.className="close",p.innerHTML="×",c.appendChild(p)}for(void 0!==e.JText._(a)&&((d=t.createElement("h4")).className="alert-heading",d.innerHTML=e.JText._(a)?e.JText._(a):a,c.appendChild(d)),m=l.length-1;m>=0;m--)(u=t.createElement("div")).innerHTML=l[m],c.appendChild(u);i.appendChild(c),"object"!=typeof window.customElements&&"function"!=typeof window.customElements.get("joomla-alert")&&s&&parseInt(s)>0&&setTimeout(function(){e.removeMessages(i)},s)}},e.removeMessages=function(e){var n;if(n=e||t.getElementById("system-message-container"),"object"==typeof window.customElements&&window.customElements.get("joomla-alert")){var o=n.querySelectorAll("joomla-alert");if(o.length)for(var r=0,s=o.length;r<s;r++)o[r].close()}else{for(;n.firstChild;)n.removeChild(n.firstChild);n.style.display="none",n.offsetHeight,n.style.display=""}},e.ajaxErrorsMessages=function(t,n,o){var r={};if("parsererror"===n){for(var s=t.responseText.trim(),i=[],a=s.length-1;a>=0;a--)i.unshift(["&#",s[a].charCodeAt(),";"].join(""));s=i.join(""),r.error=[e.JText._("JLIB_JS_AJAX_ERROR_PARSE").replace("%s",s)]}else"nocontent"===n?r.error=[e.JText._("JLIB_JS_AJAX_ERROR_NO_CONTENT")]:"timeout"===n?r.error=[e.JText._("JLIB_JS_AJAX_ERROR_TIMEOUT")]:"abort"===n?r.error=[e.JText._("JLIB_JS_AJAX_ERROR_CONNECTION_ABORT")]:t.responseJSON&&t.responseJSON.message?r.error=[e.JText._("JLIB_JS_AJAX_ERROR_OTHER").replace("%s",t.status)+" <em>"+t.responseJSON.message+"</em>"]:t.statusText?r.error=[e.JText._("JLIB_JS_AJAX_ERROR_OTHER").replace("%s",t.status)+" <em>"+t.statusText+"</em>"]:r.error=[e.JText._("JLIB_JS_AJAX_ERROR_OTHER").replace("%s",t.status)];return r},e.isChecked=function(n,o){if(void 0===o&&(o=t.getElementById("adminForm")),o.boxchecked.value=n?parseInt(o.boxchecked.value)+1:parseInt(o.boxchecked.value)-1,e.Event.dispatch(o.boxchecked,"change"),o.elements["checkall-toggle"]){var r,s,i,a=!0;for(r=0,i=o.elements.length;r<i;r++)if("checkbox"==(s=o.elements[r]).type&&"checkall-toggle"!=s.name&&!s.checked){a=!1;break}o.elements["checkall-toggle"].checked=a}},e.tableOrdering=function(n,o,r,s){void 0===s&&(s=t.getElementById("adminForm")),s.filter_order.value=n,s.filter_order_Dir.value=o,e.submitform(r,s)},window.getSelectedValue=function(e,n){var o=t[e][n],r=o.selectedIndex;return null!==r&&r>-1?o.options[r].value:null},window.listItemTask=function(t,n){return e.listItemTask(t,n)},e.listItemTask=function(e,n){var o,r=t.adminForm,s=0,i=r[e];if(!i)return!1;for(;o=r["cb"+s];)o.checked=!1,s++;return i.checked=!0,r.boxchecked.value=1,window.submitform(n),!1},window.submitbutton=function(t){e.submitbutton(t)},window.submitform=function(t){e.submitform(t)},window.saveorder=function(e,t){window.checkAll_button(e,t)},window.checkAll_button=function(n,o){var r,s;for(o=o||"saveorder",r=0;r<=n;r++){if(!(s=t.adminForm["cb"+r]))return void alert("You cannot change the order of items, as an item in the list is `Checked Out`");s.checked=!0}e.submitform(o)},e.loadingLayer=function(n,o){if(n=n||"show",o=o||t.body,"load"===n){var r=(e.getOptions("system.paths")||{}).root||"",s=t.createElement("div");s.id="loading-logo",s.style.position="fixed",s.style.top="0",s.style.left="0",s.style.width="100%",s.style.height="100%",s.style.opacity="0.8",s.style.filter="alpha(opacity=80)",s.style.overflow="hidden",s.style["z-index"]="10000",s.style.display="none",s.style["background-color"]="#fff",s.style["background-image"]='url("'+r+'/media/system/images/ajax-loader.gif")',s.style["background-position"]="center",s.style["background-repeat"]="no-repeat",s.style["background-attachment"]="fixed",o.appendChild(s)}else t.getElementById("loading-logo")||e.loadingLayer("load",o),t.getElementById("loading-logo").style.display="show"==n?"block":"none";return t.getElementById("loading-logo")},e.extend=function(e,t){for(var n in null===e&&(e={}),t)t.hasOwnProperty(n)&&(e[n]=t[n]);return e},e.request=function(t){t=e.extend({url:"",method:"GET",data:null,perform:!0},t);try{var n=window.XMLHttpRequest?new XMLHttpRequest:new ActiveXObject("MSXML2.XMLHTTP.3.0");if(n.open(t.method,t.url,!0),n.setRequestHeader("X-Requested-With","XMLHttpRequest"),n.setRequestHeader("X-Ajax-Engine","Joomla!"),"GET"!==t.method){var o=e.getOptions("csrf.token","");o&&n.setRequestHeader("X-CSRF-Token",o),t.headers&&t.headers["Content-Type"]||n.setRequestHeader("Content-Type","application/x-www-form-urlencoded")}if(t.headers)for(var r in t.headers)t.headers.hasOwnProperty(r)&&n.setRequestHeader(r,t.headers[r]);if(n.onreadystatechange=function(){4===n.readyState&&(200===n.status?t.onSuccess&&t.onSuccess.call(window,n.responseText,n):t.onError&&t.onError.call(window,n))},t.perform){if(t.onBefore&&!1===t.onBefore.call(window,n))return n;n.send(t.data)}}catch(e){return window.console&&console.log(e),!1}return n},e.localStorageEnabled=function(){var e="joomla-cms";try{return localStorage.setItem(e,e),localStorage.removeItem(e),!0}catch(e){return!1}},e.WebComponents=function(){var n=e.getOptions("webcomponents");if(n&&n.length){var o,r=!1,s=[],i=!1,a=function(){window.WebComponents.ready=!0,t.dispatchEvent(new CustomEvent("WebComponentsReady",{bubbles:!0})),m()},l=function(){window.customElements&&customElements.polyfillWrapFlushCallback&&customElements.polyfillWrapFlushCallback(function(e){o=e,i&&o()})},c=function(){window.HTMLTemplateElement&&HTMLTemplateElement.bootstrap&&HTMLTemplateElement.bootstrap(window.document),r=!0,d().then(a)},d=function(){i=!1;return Promise.all(s.map(function(e){return e instanceof Function?e():e})).then(function(){i=!0,s.length=0,o&&o()}).catch(function(e){console.error(e)})};window.WebComponents=window.WebComponents||{ready:!1,_batchCustomElements:l,waitFor:function(e){e&&(s.push(e),r&&d())}};var m=function(){n&&n.length&&n.forEach(function(e){if(e.match(/\.js/g)){var n,o=t.createElement("script");if(function(){try{return new Function("(a = 0) => a"),!0}catch(e){return!1}}())o.src=e;else e.match(/\.min\.js/g)?n=e.replace(/\.min\.js/g,"-es5.min.js"):e.match(/\.js/g)&&(n=e.replace(/\.js/g,"-es5.js")),o.src=n}o&&t.head.appendChild(o)})},u="core.min.js",f=t.querySelector('script[src*="'+u+'"]');if(f||(u="core.js",f=t.querySelector('script[src*="'+u+'"]')),!f)throw new Error("core(.min).js is not registered correctly!");var p=[];(!("attachShadow"in Element.prototype&&"getRootNode"in Element.prototype)||window.ShadyDOM&&window.ShadyDOM.force)&&p.push("sd"),window.customElements&&!window.customElements.forcePolyfill||p.push("ce");var h=function(){var e=t.createElement("template");if(!("content"in e))return!0;if(!(e.content.cloneNode()instanceof DocumentFragment))return!0;var n=t.createElement("template");n.content.appendChild(t.createElement("div")),e.content.appendChild(n);var o=e.cloneNode(!0);return 0===o.content.childNodes.length||0===o.content.firstChild.content.childNodes.length}();if(window.Promise&&Array.from&&window.URL&&window.Symbol&&!h||(p=["sd-ce-pf"]),p.length){var g=t.createElement("script"),w="media/vendor/webcomponentsjs/js/webcomponents-"+p.join("-")+".min.js",v=f.src.match(/\?.*/)[0],y=e.getOptions("system.paths");if(!y)throw new Error("core(.min).js is not registered correctly!");g.src=y.rootFull+w+(v||""),"loading"===t.readyState?(g.setAttribute("onload","window.WebComponents._batchCustomElements()"),t.write(g.outerHTML),t.addEventListener("DOMContentLoaded",c)):(g.addEventListener("load",function(){l(),c()}),g.addEventListener("error",function(){throw new Error("Could not load polyfill bundle"+url)}),t.head.appendChild(g))}else r=!0,"complete"===t.readyState?a():(window.addEventListener("load",c),window.addEventListener("DOMContentLoaded",function(){window.removeEventListener("load",c),c()}))}}}(Joomla,document),function(e,t){"use strict";t.Event||(t.Event={},t.Event.dispatch=function(t,n,o){var r;"string"==typeof t&&(o=n,n=t,t=e),o=o||{},e.CustomEvent&&"function"==typeof e.CustomEvent?r=new CustomEvent(n,{detail:o,bubbles:!0,cancelable:!0}):((r=document.createEvent("Event")).initEvent(n,!0,!0),r.detail=o),t.dispatchEvent(r)},t.Event.listenOnce=function(e,t,n){var o=function(r){return e.removeEventListener(t,o),n.call(e,r)};e.addEventListener(t,o)})}(window,Joomla),document.addEventListener("DOMContentLoaded",function(){Joomla.WebComponents()});
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L641

Insecure DOM Manipulation (XSS) in calendar.js

CWE-79
File Location: media/system/js/fields/calendar.js:641
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- cell.innerHTML = JoomlaCalLocale.wk;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L997

Insecure DOM Manipulation (XSS) in calendar.js

CWE-79
File Location: media/system/js/fields/calendar.js:997
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- this._nav_month.getElementsByTagName('span')[0].innerHTML = !this.params.monthBefore ? JoomlaCalLocale.months[month] + ' - ' + tmpYear : tmpYear + ' - ' + JoomlaCalLocale.months[month] ;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L93

Insecure DOM Manipulation (XSS) in passwordstrength.js

CWE-79
File Location: media/system/js/fields/passwordstrength.js:93
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- label.innerHTML = Joomla.JText._('JFIELD_PASSWORD_INDICATE_INCOMPLETE');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in validate.min.js

CWE-79
File Location: media/system/js/fields/validate.min.js:1
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- var JFormValidator=function(){"use strict";var e,t,a,r=function(t,a,r){r=""===r||r,e[t]={enabled:r,exec:a}},s=function(e,t,a){"button"!==t.tagName.toLowerCase()&&"undefined"!==t.value&&(!1===e?i(t,a):n(t))},n=function(e){var t,a=e.form.querySelector('label[for="'+e.id+'"]');(e.classList.contains("required")||e.getAttribute("required"))&&(a&&(t=a.querySelector("span.form-control-feedback")));e.classList.remove("form-control-danger"),e.classList.add("form-control-success"),e.parentNode.classList.remove("has-danger"),e.parentNode.classList.add("has-success"),e.setAttribute("aria-invalid","false"),t&&t.parentNode.removeChild(t),a&&a.classList.remove("invalid")},i=function(e,t){var a=e.form.querySelector('label[for="'+e.id+'"]');e.classList.remove("form-control-success"),e.classList.add("form-control-danger"),e.classList.add("invalid"),e.parentNode.classList.remove("has-success"),e.parentNode.classList.add("has-danger"),e.setAttribute("aria-invalid","true");var r,s=e.getAttribute("data-validation-text");if(a&&(r=a.querySelector("span.form-control-feedback")),!r){var n=document.createElement("span");n.classList.add("form-control-feedback"),n.innerHTML=t&&"checkbox"===t?s||Joomla.JText._("JLIB_FORM_FIELD_REQUIRED_CHECK"):t&&"value"===t?s||Joomla.JText._("JLIB_FORM_FIELD_REQUIRED_VALUE"):s||Joomla.JText._("JLIB_FORM_FIELD_INVALID_VALUE"),a&&a.appendChild(n)}a&&a.classList.add("invalid")},o=function(t){var a,r;if("disabled"===t.getAttribute("disabled")||"none"===t.getAttribute("display"))return s(!0,t),!0;if(t.getAttribute("required")||t.classList.contains("required"))if("fieldset"===(a=t.tagName.toLowerCase())&&(t.classList.contains("radio")||t.classList.contains("checkboxes"))){if(!t.querySelector("input:checked").length)return s(!1,t,"checkbox"),!1}else{if("checkbox"===t.getAttribute("type")&&0!==!t.checked.length||"select"===a&&!t.value.length)return s(!1,t,"checkbox"),!1;if(!t.value||t.classList.contains("placeholder"))return s(!1,t,"value"),!1}return r=t.getAttribute("class")&&t.getAttribute("class").match(/validate-([a-zA-Z0-9\_\-]+)/)?t.getAttribute("class").match(/validate-([a-zA-Z0-9\_\-]+)/)[1]:"",t.getAttribute("pattern")&&""!=t.getAttribute("pattern")?t.value.length?(l=new RegExp("^"+t.getAttribute("pattern")+"$").test(t.value),s(l,t,"empty"),l):(s(!1,t),!1):""===r?(s(!0,t),!0):r&&"none"!==r&&e[r]&&t.value&&!0!==e[r].exec(t.value,t)?(s(!1,t,"invalid_value"),!1):(s(!0,t),!0)},l=function(e){var t,r,s,n,i=!0,l=[];for(s=0,n=(t=e.querySelectorAll("input, textarea, select, button")).length;s<n;s++)!1===o(t[s])&&(i=!1,l.push(t[s]));for(var c in a)a.hasOwnProperty(c)&&!0!==a[validator].exec()&&(i=!1);return function(e,t){for(var a=0,r=e.length;a<r;++a)t(e[a],a)}(a,function(e,t){!0!==t.exec()&&(i=!1)}),!i&&l.length>0&&(r={error:[e.getAttribute("data-validation-text")?e.getAttribute("data-validation-text"):Joomla.JText._("JLIB_FORM_CONTAINS_INVALID_FIELDS")]},Joomla.renderMessages(r)),i},c=function(e){for(var a,r=[],s=0,n=(a=e.querySelectorAll("input, textarea, select, button, fieldset")).length;s<n;s++){var i=a[s],c=i.tagName.toLowerCase();["input","textarea","select","fieldset"].indexOf(c)>-1&&i.classList.contains("required")&&i.setAttribute("required",""),"input"!==c&&"button"!==c||"submit"!==i.getAttribute("type")&&"image"!==i.getAttribute("type")?"button"===c||"input"===c&&"button"===i.getAttribute("type")||("fieldset"!==c&&(i.addEventListener("blur",function(){return o(this)}),i.addEventListener("focus",function(){return(a=(e=this).form.querySelector('label[for="'+e.id+'"]'))&&(t=a.querySelector("span.form-control-feedback")),e.classList.remove("form-control-danger"),e.classList.remove("form-control-success"),e.classList.remove("invalid"),e.classList.add("valid"),e.parentNode.classList.remove("has-danger"),e.parentNode.classList.remove("has-success"),t&&a&&a.removeChild(t),void(a&&a.classList.remove("invalid"));var e,t,a}),i.classList.contains("validate-email")&&t&&i.setAttribute("type","email")),r.push(i)):i.classList.contains("validate")&&i.addEventListener("click",function(){return l(e)})}};return function(){var s;e={},a=a||{},(s=document.createElement("input")).setAttribute("type","email"),t="text"!==s.type,r("username",function(e,t){return!new RegExp("[<|>|\"|'|%|;|(|)|&]","i").test(e)}),r("password",function(e,t){return/^\S[\S ]{2,98}\S$/.test(e)}),r("numeric",function(e,t){return/^(\d|-)?(\d|,)*\.?\d*$/.test(e)}),r("email",function(e,t){return e=punycode.toASCII(e),/^[a-zA-Z0-9.!#$%&’*+\/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$/.test(e)});for(var n=document.querySelectorAll("form"),i=0,o=n.length;i<o;i++)n[i].classList.contains("form-validate")&&c(n[i])}(),{isValid:l,validate:o,setHandler:r,attachToForm:c,custom:a}};document.formvalidator=null,document.addEventListener("DOMContentLoaded",function(){document.formvalidator=new JFormValidator});
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L209

Insecure DOM Manipulation (XSS) in joomla-field-simple-color.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-simple-color.js:209
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- el.innerHTML = `<span class="sr-only">${a11yColor}</span>`;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L151

Insecure DOM Manipulation (XSS) in joomla-field-subform.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-subform.js:151
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- this.template = tmplElement[0].innerHTML;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L110

Insecure DOM Manipulation (XSS) in joomla-field-user-es5.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-user-es5.js:110
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- this.modalBody.innerHTML = '';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in associations-edit.min.js

CWE-79
File Location: media/com_associations/js/associations-edit.min.js:1
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- Joomla=window.Joomla||{},function(e,o){"use strict";e.hideAssociation=function(e,t){[].slice.call(o.querySelectorAll("#associations .control-group")).forEach(function(o){var a=o.querySelector(".control-label label");a&&(a.getAttribute("for").replace("_id","")===e+"_associations_"+t.replace("-","_")&&(o.style.display="none"))})},e.showAssociationMessage=function(){[].slice.call(o.querySelectorAll("#associations .control-group")).forEach(function(t){t.style.display="none";var a=o.getElementById("associations");if(a){var s=o.createElement("div");s.classList.add("alert"),s.classList.add("alert-info"),s.id="associations-notice",s.innerHTML=e.JText._("JGLOBAL_ASSOC_NOT_POSSIBLE"),a.insertAdjacentElement("afterbegin",s)}})},o.addEventListener("DOMContentLoaded",function(){var t=e.getOptions("system.associations.edit"),a=t.formControl||"jform",s=o.getElementById(a+"_language");1===parseInt(t.hidden,10)?e.showAssociationMessage():s&&e.hideAssociation(a,s.value),s&&s.addEventListener("change",function(t){e.removeMessages();var s=!1;[].slice.call(o.querySelectorAll("#associations .control-group")).forEach(function(e){var t=e.querySelector(".control-label label").getAttribute("for").replace("_id","").replace("jform_associations_","");e.style.display="block",s||""===o.getElementById(a+"_associations_"+t+"_id").value||(s=!0);var i=o.getElementById(a+"_associations_"+t+"_clear");i.onclick?i.onclick():i.click&&i.click()}),s&&e.renderMessages({warning:[e.JText._("JGLOBAL_ASSOCIATIONS_RESET_WARNING")]});var i=t.target.value;"*"===i?e.showAssociationMessage():e.hideAssociation(a,i)})})}(Joomla,document);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L205

Insecure DOM Manipulation (XSS) in sidebyside.js

CWE-79
File Location: media/com_associations/js/sidebyside.js:205
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- document.getElementById('select-change-text').innerHTML = document.getElementById('select-change').getAttribute('data-select');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in overrider.min.js

CWE-79
File Location: media/com_languages/js/overrider.min.js:1
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- Joomla.overrider={states:{refreshing:!1,refreshed:!1,counter:0,searchstring:"",searchtype:"value"}},Joomla.overrider.refreshCache=function(){this.states.refreshing=!0;var e=this,s=document.getElementById("refresh-status");s.classList.add("show"),Joomla.request({url:"index.php?option=com_languages&task=strings.refresh&format=json",method:"POST",headers:{"Content-Type":"application/json"},onSuccess:function(t){t.error&&t.message&&alert(t.message),t.messages&&Joomla.renderMessages(t.messages),s.classList.remove("show"),e.states.refreshing=!1},onError:function(e){alert(Joomla.JText._("COM_LANGUAGES_VIEW_OVERRIDE_REQUEST_ERROR")),s.classList.remove("show")}})},Joomla.overrider.searchStrings=function(e){var s=this,t=document.getElementById("jform_searchstring"),r=document.getElementById("jform_searchtype"),a=document.getElementById("overrider-spinner"),o=document.getElementById("overrider-spinner-btn"),n=document.getElementById("more-results"),i=document.getElementById("results-container");if(!this.states.refreshing){if(!e){this.states.searchstring=t.value,this.states.searchtype=null!==r?r.value:"value";for(var l=document.querySelectorAll(".language-results"),d=0,c=l.length;d<c;d++)l[d].parentNode.removeChild(l[d])}if(this.states.searchstring){if(e)o.classList.add("show");else{n.classList.remove("show");var m=document.querySelectorAll("#results-container div.language-results");for(d=0,c=m.length;d<c;d++)m[d].parentNode.removeChild(m[d]);i.classList.add("show"),a.classList.add("show")}Joomla.request({url:"index.php?option=com_languages&task=strings.search&format=json&searchstring="+s.states.searchstring+"&searchtype="+s.states.searchtype+"&more="+e,method:"POST",headers:{"Content-Type":"application/json"},onSuccess:function(e){(e=JSON.parse(e)).error&&e.message&&alert(e.message),e.messages&&Joomla.renderMessages(e.messages),e.data&&(e.data.results&&s.insertResults(e.data.results),e.data.more&&(s.states.more=e.data.more,n.classList.add("show"))),o.classList.remove("show"),a.classList.remove("show")},onError:function(e){alert(Joomla.JText._("COM_LANGUAGES_VIEW_OVERRIDE_REQUEST_ERROR")),n.classList.remove("show"),i.classList.remove("show")}})}else t.classList.add("invalid")}},Joomla.overrider.insertResults=function(e){var s=this;this.states.counter=this.states.counter+1;var t=document.createElement("div");if(t.setAttribute("id","language-results"+s.states.counter),t.classList.add("language-results"),t.classList.add("list-group"),t.classList.add("mb-2"),t.classList.add("show"),e.forEach(function(e,r){var a=document.createElement("a");a.setAttribute("onclick","Joomla.overrider.selectString("+s.states.counter+r+");"),a.setAttribute("href","#"),a.classList.add("list-group-item"),a.classList.add("list-group-item-action"),a.classList.add("flex-column"),a.classList.add("align-items-start");var o=document.createElement("div");o.setAttribute("id","override_key"+s.states.counter+r),o.setAttribute("title",e.file),o.classList.add("result-key"),o.innerHTML=e.constant;var n=document.createElement("div");n.setAttribute("id","override_string"+s.states.counter+r),n.classList.add("result-string"),n.innerHTML=e.string,a.appendChild(o),a.appendChild(n),t.appendChild(a)}),!e.length){var r=document.createElement("div");r.innerHTML=Joomla.JText._("COM_LANGUAGES_VIEW_OVERRIDE_NO_RESULTS"),t.appendChild(r)}var a=document.getElementById("more-results");a&&a.parentNode.insertBefore(t,a)},Joomla.overrider.selectString=function(e){document.getElementById("jform_key").value=document.getElementById("override_key"+e).innerHTML,document.getElementById("jform_override").value=document.getElementById("override_string"+e).innerHTML};
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L289

Insecure DOM Manipulation (XSS) in chosen.js

CWE-79
File Location: media/legacy/js/chosen.js:289
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- option_el.innerHTML = option.search_text;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L39

Insecure DOM Manipulation (XSS) in helpsite.js

CWE-79
File Location: media/legacy/js/helpsite.js:39
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- node.innerHTML = item.text;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L29

Insecure DOM Manipulation (XSS) in extensionupdatecheck.es6.js

CWE-79
File Location: media/plg_quickicon_extensionupdate/js/extensionupdatecheck.es6.js:29
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- linkSpan[i].innerHTML = Joomla.JText._('PLG_QUICKICON_EXTENSIONUPDATE_UPTODATE');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L33

Insecure DOM Manipulation (XSS) in jupdatecheck.js

CWE-79
File Location: media/plg_quickicon_joomlaupdate/js/jupdatecheck.js:33
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- linkSpan[i].innerHTML = Joomla.JText._('PLG_QUICKICON_JOOMLAUPDATE_UPTODATE');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L59

Insecure DOM Manipulation (XSS) in jupdatecheck.js

CWE-79
File Location: media/plg_quickicon_joomlaupdate/js/jupdatecheck.js:59
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- linkSpan[i].innerHTML = Joomla.JText._('PLG_QUICKICON_JOOMLAUPDATE_UPTODATE');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in jupdatecheck.min.js

CWE-79
File Location: media/plg_quickicon_joomlaupdate/js/jupdatecheck.min.js:1
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- !function(){"use strict";var e=function(){if(Joomla.getOptions("js-joomla-update")){var e=Joomla.getOptions("js-joomla-update");Joomla.request({url:e.ajaxUrl+"&eid=700&cache_timeout=3600",method:"GET",data:"",perform:!0,onSuccess:function(o,n){var a=document.getElementById("plg_quickicon_joomlaupdate"),t=a.querySelectorAll("span.j-links-link"),l=JSON.parse(o);if(l instanceof Array)if(0===l.length){a.classList.add("success");for(var s=0,r=t.length;s<r;s++)t[s].innerHTML=Joomla.JText._("PLG_QUICKICON_JOOMLAUPDATE_UPTODATE")}else{if(l.shift().version!=e.version){var i={message:[Joomla.JText._("PLG_QUICKICON_JOOMLAUPDATE_UPDATEFOUND_MESSAGE").replace("%s",'<span class="badge badge-light">'+l.length+"</span>")+'<button class="btn btn-primary" onclick="document.location=\''+e.url+"'\">"+Joomla.JText._("PLG_QUICKICON_JOOMLAUPDATE_UPDATEFOUND_BUTOON")+"</button>"],error:["info"]};Joomla.renderMessages(i),window.scrollTo(0,0),a.classList.add("danger");for(s=0,r=t.length;s<r;s++)t[s].innerHTML=Joomla.JText._("PLG_QUICKICON_JOOMLAUPDATE_UPDATEFOUND").replace("%s",'<span class="badge badge-light">'+l.length+"</span>")}else for(s=0,r=t.length;s<r;s++)t[s].innerHTML=Joomla.JText._("PLG_QUICKICON_JOOMLAUPDATE_UPTODATE")}else{a.classList.add("danger");for(s=0,r=t.length;s<r;s++)t[s].innerHTML=Joomla.JText._("PLG_QUICKICON_JOOMLAUPDATE_ERROR")}},onError:function(e){var o=document.getElementById("plg_quickicon_joomlaupdate"),n=o.querySelectorAll("span.j-links-link");o.classList.add("danger");for(var a=0,t=n.length;a<t;a++)n[a].innerHTML=Joomla.JText._("PLG_QUICKICON_JOOMLAUPDATE_ERROR")}})}};document.addEventListener("DOMContentLoaded",function(){setTimeout(e,2e3)})}();
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L994

Insecure DOM Manipulation (XSS) in calendar.js

CWE-79
File Location: media/system/js/fields/calendar.js:994
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- this.title.getElementsByTagName('span')[0].innerHTML = this.params.debug ? year + ' ' + Date.convertNumbers(year.toString()) : Date.convertNumbers(year.toString());
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in calendar.min.js

CWE-79
File Location: media/system/js/fields/calendar.min.js:1
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- !function(e,a){"use strict";Date.convertNumbers=function(e){e=e.toString();if("[object Array]"===Object.prototype.toString.call(JoomlaCalLocale.localLangNumbers))for(var a=0;a<JoomlaCalLocale.localLangNumbers.length;a++)e=e.replace(new RegExp(a,"g"),JoomlaCalLocale.localLangNumbers[a]);return e},Date.toEnglish=function(e){e=this.toString();for(var a=[0,1,2,3,4,5,6,7,8,9],t=0;t<10;t++)e=e.replace(new RegExp(a[t],"g"),t);return e};var t=function(e){if(!e)throw new Error("Calendar setup failed:\n No valid element found, Please check your code");if("function"!=typeof Date.parseFieldDate)throw new Error("Calendar setup failed:\n No valid date helper, Please check your code");if(e._joomlaCalendar)throw new Error("JoomlaCalendar instance already exists for the element");if(e._joomlaCalendar=this,this.writable=!0,this.hidden=!0,this.params={},this.element=e,this.inputField=e.getElementsByTagName("input")[0],this.button=e.getElementsByTagName("button")[0],!this.inputField)throw new Error("Calendar setup failed:\n No valid input found, Please check your code");this.params={debug:!1,clicked:!1,element:{style:{display:"none"}},writable:!0};var t=this,s=this.button,r={inputField:this.inputField,dateType:JoomlaCalLocale.dateType?JoomlaCalLocale.dateType:"gregorian",direction:void 0!==a.dir?a.dir:a.getElementsByTagName("html")[0].getAttribute("dir"),firstDayOfWeek:s.getAttribute("data-firstday")?parseInt(s.getAttribute("data-firstday")):0,dateFormat:"%Y-%m-%d %H:%M:%S",weekend:JoomlaCalLocale.weekend?JoomlaCalLocale.weekend:[0,6],minYear:JoomlaCalLocale.minYear?JoomlaCalLocale.minYear:1900,maxYear:JoomlaCalLocale.maxYear?JoomlaCalLocale.maxYear:2100,minYearTmp:s.getAttribute("data-min-year"),maxYearTmp:s.getAttribute("data-max-year"),weekendTmp:s.getAttribute("data-weekend"),time24:!0,showsOthers:1===parseInt(s.getAttribute("data-show-others")),showsTime:!0,weekNumbers:1===parseInt(s.getAttribute("data-week-numbers")),showsTodayBtn:!0,compressedHeader:1===parseInt(s.getAttribute("data-only-months-nav"))};for(var o in s.getAttribute("data-dayformat")&&(r.dateFormat=s.getAttribute("data-dayformat")?s.getAttribute("data-dayformat"):"%Y-%m-%d %H:%M:%S"),s.getAttribute("data-time-24")&&(r.time24=24===parseInt(s.getAttribute("data-time-24"))),s.getAttribute("data-show-time")&&(r.showsTime=1===parseInt(s.getAttribute("data-show-time"))),s.getAttribute("data-today-btn")&&(r.showsTodayBtn=1===parseInt(s.getAttribute("data-today-btn"))),r)this.params[o]=r[o];i(t.params.minYearTmp)&&(t.params.minYear=l(parseInt(t.params.minYearTmp),t.params.dateType)),i(t.params.maxYearTmp)&&(t.params.maxYear=l(parseInt(t.params.maxYearTmp),t.params.dateType)),"undefined"!==t.params.weekendTmp&&(t.params.weekend=t.params.weekendTmp.split(",").map(function(e){return parseInt(e,10)})),this._dayMouseDown=function(e){return t._handleDayMouseDown(e)},this._calKeyEvent=function(e){return t._handleCalKeyEvent(e)},this._documentClick=function(e){return t._handleDocumentClick(e)},this.checkInputs(),this.inputField.getAttribute("readonly")||(this._create(),this._bindEvents())};t.prototype.checkInputs=function(){var e=Date.parseFieldDate(this.inputField.getAttribute("data-alt-value"),this.params.dateFormat,"gregorian");""!==this.inputField.value?(this.date=e,this.inputField.value=e.print(this.params.dateFormat,this.params.dateType,!0)):this.date=new Date},t.prototype.recreate=function(){var e=this.element,a=e.querySelector(".js-calendar");a&&(e._joomlaCalendar=null,a.parentNode.removeChild(a),new t(e))},t.prototype.updateTime=function(e,a,t){var s=this.date,r=this.date.getLocalDate(this.params.dateType),i=this.date.getLocalMonth(this.params.dateType),l=this.date.getLocalFullYear(this.params.dateType),o=this.inputField.parentNode.parentNode.querySelectorAll(".time-ampm")[0];this.params.time24||(/pm/i.test(o.value)&&e<12?e=parseInt(e)+12:/am/i.test(o.value)&&12==e&&(e=0)),s.setHours(e),s.setMinutes(parseInt(a,10)),s.setSeconds(s.getSeconds()),s.setLocalFullYear(this.params.dateType,l),s.setLocalMonth(this.params.dateType,i),s.setLocalDate(this.params.dateType,r),this.dateClicked=!1,this.callHandler()},t.prototype.setDate=function(e){e.equalsTo(this.date)||(this.date=e,this.processCalendar(this.params.firstDayOfWeek,e))},t.prototype.moveCursorBy=function(e){var a=new Date(this.date);a.setDate(a.getDate()-e),this.setDate(a)},t.prototype.resetSelected=function(e){for(var a=e.options,t=a.length;t--;){var s=a[t];s.selected&&(s.selected=!1)}},t.prototype.callHandler=function(){this.inputField.setAttribute("data-alt-value",this.date.print(this.params.dateFormat,"gregorian",!1)),this.inputField.getAttribute("data-alt-value")&&"0000-00-00 00:00:00"!==this.inputField.getAttribute("data-alt-value")&&(this.inputField.value=this.date.print(this.params.dateFormat,this.params.dateType,!0),"gregorian"!==this.params.dateType&&this.inputField.setAttribute("data-local-value",this.date.print(this.params.dateFormat,this.params.dateType,!0))),this.inputField.value=this.date.print(this.params.dateFormat,this.params.dateType,!0),"function"==typeof this.inputField.onchange&&this.inputField.onchange(),this.dateClicked&&"function"==typeof this.params.onUpdate&&this.params.onUpdate(this),this.dateClicked?this.close():this.processCalendar()},t.prototype.close=function(){this.hide()},t.prototype.show=function(){if(-1!==navigator.appName.indexOf("Internet Explorer")&&(-1===navigator.appVersion.indexOf("MSIE 9")&&-1===navigator.appVersion.indexOf("MSIE 1")&&e.jQuery&&jQuery().chosen))for(var t=this.element.getElementsByTagName("select"),s=0;s<t.length;s++)jQuery(t[s]).chosen("destroy");this.checkInputs(),this.inputField.focus(),this.dropdownElement.style.display="block",this.hidden=!1,a.addEventListener("keydown",this._calKeyEvent,!0),a.addEventListener("keypress",this._calKeyEvent,!0),a.addEventListener("mousedown",this._documentClick,!0);var r=this.element.querySelector(".js-calendar");e.innerHeight+e.scrollY<r.getBoundingClientRect().bottom+20&&(r.style.marginTop=-(r.getBoundingClientRect().height+this.inputField.getBoundingClientRect().height)+"px"),this.processCalendar()},t.prototype.hide=function(){a.removeEventListener("keydown",this._calKeyEvent,!0),a.removeEventListener("keypress",this._calKeyEvent,!0),a.removeEventListener("mousedown",this._documentClick,!0),this.dropdownElement.style.display="none",this.hidden=!0},t.prototype._handleDocumentClick=function(e){var t=e.target;if(null!==t&&!t.classList.contains("time"))for(;null!==t&&t!==this.element;t=t.parentNode);if(null===t)return a.activeElement.blur(),this.hide(),s(e)},t.prototype._handleDayMouseDown=function(e){var a=e.currentTarget,t=e.target||e.srcElement;if(!t||!t.hasAttribute("data-action")){if("TD"!==a.nodeName){var r=a.getParent("TD");"TD"===r.nodeName?a=r:(a=a.getParent("TD")).classList.contains("js-calendar")&&(a=a.getElementsByTagName("table")[0])}else if(!t.classList.contains("js-btn")&&!a.classList.contains("day")&&!a.classList.contains("title"))return;if(!a||a.disabled)return!1;if(void 0===a.navtype||300!==a.navtype){50===a.navtype&&(a._current=a.innerHTML),t!==a&&t.parentNode!==a||this.cellClick(a,e);var i=null;void 0!==a.month&&(i=a),void 0!==a.parentNode.month&&(i=a.parentNode);var l=null;if(i)l=new Date(this.date),i.month!==l.getLocalMonth(this.params.dateType)&&(l.setLocalMonth(this.params.dateType,i.month),this.setDate(l),this.dateClicked=!1,this.callHandler());else{var o=null;void 0!==a.year&&(o=t),void 0!==a.parentNode.year&&(o=t.parentNode),o&&(l=new Date(this.date),o.year!==l.getLocalFullYear(this.params.dateType)&&(l.setFullYear(this.params.dateType,o.year),this.setDate(l),this.dateClicked=!1,this.callHandler()))}}return s(e)}},t.prototype.cellClick=function(e,a){var t=!1,s=!1,r=null;if(void 0===e.navtype){this.currentDateEl&&(e.classList.add("selected"),this.currentDateEl=e.caldate,(t=this.currentDateEl===e.caldate)||(this.currentDateEl=e.caldate)),this.date.setLocalDateOnly("gregorian",e.caldate);var i=!(this.dateClicked=!e.otherMonth);this.currentDateEl&&(s=!e.disabled),i&&this.processCalendar()}else{r=new Date(this.date),this.dateClicked=!1;var l=r.getOtherFullYear(this.params.dateType),o=r.getLocalMonth(this.params.dateType);switch(e.navtype){case 400:break;case-2:this.params.compressedHeader||l>this.params.minYear&&r.setOtherFullYear(this.params.dateType,l-1);break;case-1:var n=r.getLocalDate(this.params.dateType);if(o>0)n>(d=r.getLocalMonthDays(this.params.dateType,o-1))&&r.setLocalDate(this.params.dateType,d),r.setLocalMonth(this.params.dateType,o-1);else if(l-- >this.params.minYear){r.setOtherFullYear(this.params.dateType,l),n>(d=r.getLocalMonthDays(this.params.dateType,11))&&r.setLocalDate(this.params.dateType,d),r.setLocalMonth(this.params.dateType,11)}break;case 1:n=r.getLocalDate(this.params.dateType);if(o<11)n>(d=r.getLocalMonthDays(this.params.dateType,o+1))&&r.setLocalDate(this.params.dateType,d),r.setLocalMonth(this.params.dateType,o+1);else if(l<this.params.maxYear){var d;r.setOtherFullYear(this.params.dateType,l+1),n>(d=r.getLocalMonthDays(this.params.dateType,0))&&r.setLocalDate(this.params.dateType,d),r.setLocalMonth(this.params.dateType,0)}break;case 2:this.params.compressedHeader||l<this.params.maxYear&&r.setOtherFullYear(this.params.dateType,l+1)}r.equalsTo(this.date)?0===e.navtype&&(s=t=!0):(this.setDate(r),s=!0)}s&&(this.params.showsTime&&(this.dateClicked=!1),a&&this.callHandler()),e.classList.remove("hilite"),t&&!this.params.showsTime&&(this.dateClicked=!1,a&&this.close())},t.prototype._handleCalKeyEvent=function(e){var a=e.keyCode;if(e.target!==this.inputField||13!==a&&9!==a||this.close(),"rtl"===this.params.direction&&(37===a?a=39:39===a&&(a=37)),32===a&&e.shiftKey&&(e.preventDefault(),this.cellClick(this._nav_now,e),this.close()),27===a&&this.close(),38===a&&this.moveCursorBy(7),40===a&&this.moveCursorBy(-7),37===a&&this.moveCursorBy(1),39===a&&this.moveCursorBy(-1),e.target===this.inputField&&!(a>48||a<57||186===a||189===a||190===a||32===a))return s(e)},t.prototype._create=function(){var e=this,a=this.element,t=r("table"),s=r("div");this.table=t,t.className="table",t.cellSpacing=0,t.cellPadding=0,t.style.marginBottom=0,this.dropdownElement=s,a.appendChild(s),this.params.direction&&(s.style.direction=this.params.direction),s.className="js-calendar",s.style.position="absolute",s.style.boxShadow="0px 0px 70px 0px rgba(0,0,0,0.67)",s.style.minWidth=this.inputField.width,s.style.padding="0",s.style.display="none",s.style.left="auto",s.style.top="auto",s.style.zIndex=1060,s.style.borderRadius="20px",this.wrapper=r("div"),this.wrapper.className="calendar-container",s.appendChild(this.wrapper),this.wrapper.appendChild(t);var i=r("thead",t);i.className="calendar-header";var l=null,o=null,n=this,d=function(a,t,s,i,d,m,p){for(var c in i=i||"td",d=d||{},l=r(i,o),t&&(m=m?'class="'+m+'"':"",l.colSpan=t),d)l.style[c]=d[c];for(var c in p)l.setAttribute(c,p[c]);return 0!==s&&Math.abs(s)<=2&&(l.className+=" nav"),t&&l.addEventListener("mousedown",e._dayMouseDown,!0),l.calendar=n,l.navtype=s,0!==s&&Math.abs(s)<=2?l.innerHTML="<a "+m+" style='display:inline;padding:2px 6px;cursor:pointer;text-decoration:none;' unselectable='on'>"+a+"</a>":(l.innerHTML=t?"<div unselectable='on'"+m+">"+a+"</div>":a,!t&&m&&(l.className=m)),l};!1===this.params.compressedHeader&&((o=r("tr",i)).className="calendar-head-row",this._nav_py=d("&lsaquo;",1,-2,"",{"text-align":"center","font-size":"18px","line-height":"18px"},"js-btn btn-prev-year"),this.title=d('<div style="text-align:center;font-size:18px"><span></span></div>',this.params.weekNumbers?6:5,300),this.title.className="title",this._nav_ny=d(" &rsaquo;",1,2,"",{"text-align":"center","font-size":"18px","line-height":"18px"},"js-btn btn-next-year")),(o=r("tr",i)).className="calendar-head-row",this._nav_pm=d("&lsaquo;",1,-1,"",{"text-align":"center","font-size":"2em","line-height":"1em"},"js-btn btn-prev-month"),this._nav_month=d('<div style="text-align:center;font-size:1.2em"><span></span></div>',this.params.weekNumbers?6:5,888,"td",{textAlign:"center"}),this._nav_month.className="title",this._nav_nm=d(" &rsaquo;",1,1,"",{"text-align":"center","font-size":"2em","line-height":"1em"},"js-btn btn-next-month"),(o=r("tr",i)).className=e.params.weekNumbers?"daynames wk":"daynames",this.params.weekNumbers&&((l=r("td",o)).className="day-name wn",l.innerHTML=JoomlaCalLocale.wk);for(var m=7;m>0;--m)l=r("td",o),m||(l.calendar=e);this.firstdayname=this.params.weekNumbers?o.firstChild.nextSibling:o.firstChild;var p=this.params.firstDayOfWeek,c=(l=this.firstdayname,JoomlaCalLocale.weekend);for(m=0;m<7;++m){var h=(m+p)%7;l.classList.add("day-name"),this.params.weekNumbers&&l.classList.add("day-name-week"),m&&(l.calendar=e,l.fdow=h),-1!==c.indexOf(c)&&l.classList.add("weekend"),l.innerHTML=JoomlaCalLocale.shortDays[(m+p)%7],l=l.nextSibling}var u=r("tbody",t);for(this.tbody=u,m=6;m>0;--m){o=r("tr",u),this.params.weekNumbers&&(l=r("td",o));for(var y=7;y>0;--y)(l=r("td",o)).calendar=this,l.addEventListener("mousedown",this._dayMouseDown,!0)}if(this.params.showsTime){(o=r("tr",u)).className="time",(l=r("td",o)).className="time time-title",l.colSpan=1,l.style.verticalAlign="middle",l.innerHTML=" ";var v=r("td",o);v.className="time hours-select",v.colSpan=2;var g=r("td",o);g.className="time minutes-select",g.colSpan=2,function(){function a(a,t,s,i,l){var o,n=r("select",l);n.calendar=e,n.className=a,n.setAttribute("data-chosen",!0),n.style.width="100%",n.navtype=50,n._range=[];for(var d=s;d<=i;++d){var m,p="";d===t&&(p=!0),d<10&&i>=10?(o="0"+d,m=Date.convertNumbers("0")+Date.convertNumbers(d)):(o=""+d,m=""+Date.convertNumbers(d)),n.options.add(new Option(m,o,p,p))}return n}var t=e.date.getHours(),s=e.date.getMinutes(),i=!e.params.time24,n=e.date.getHours()>12;i&&n&&(t-=12);var d=a("time time-hours",t,i?1:0,i?12:23,v),m=a("time time-minutes",s,0,59,g);if((l=r("td",o)).className="time ampm-select",l.colSpan=e.params.weekNumbers?1:2,i){n=Date.parseFieldDate(e.inputField.getAttribute("data-alt-value"),e.params.dateFormat,"gregorian").getHours()>=12;var p=r("select",l);p.className="time-ampm",p.style.width="100%",p.options.add(new Option(JoomlaCalLocale.PM,"pm",!!n||"",!!n||"")),p.options.add(new Option(JoomlaCalLocale.AM,"am",!n||"",!n||"")),p.addEventListener("change",function(a){e.updateTime(a.target.parentNode.parentNode.childNodes[1].childNodes[0].value,a.target.parentNode.parentNode.childNodes[2].childNodes[0].value,a.target.parentNode.parentNode.childNodes[3].childNodes[0].value)},!1)}else l.innerHTML="&#160;",l.colSpan=e.params.weekNumbers?3:2;d.addEventListener("change",function(a){e.updateTime(a.target.parentNode.parentNode.childNodes[1].childNodes[0].value,a.target.parentNode.parentNode.childNodes[2].childNodes[0].value,a.target.parentNode.parentNode.childNodes[3].childNodes[0].value)},!1),m.addEventListener("change",function(a){e.updateTime(a.target.parentNode.parentNode.childNodes[1].childNodes[0].value,a.target.parentNode.parentNode.childNodes[2].childNodes[0].value,a.target.parentNode.parentNode.childNodes[3].childNodes[0].value)},!1)}()}((o=r("div",this.wrapper)).className="buttons-wrapper btn-group",this._nav_save=d(JoomlaCalLocale.save,"",100,"button","","js-btn btn btn-clear",{type:"button","data-action":"clear"}),this.inputField.hasAttribute("required"))||o.querySelector('[data-action="clear"]').addEventListener("click",function(a){a.preventDefault();for(var t=e.table.querySelectorAll("td"),s=0;s<t.length;s++)if(t[s].classList.contains("selected")){t[s].classList.remove("selected");break}e.inputField.setAttribute("data-alt-value","0000-00-00 00:00:00"),e.inputField.setAttribute("value",""),e.inputField.value=""});this.params.showsTodayBtn&&(this._nav_now=d(JoomlaCalLocale.today,"",0,"button","","js-btn btn btn-today",{type:"button","data-action":"today"}),this.wrapper.querySelector('[data-action="today"]').addEventListener("click",function(a){a.preventDefault(),e.date.setLocalDateOnly("gregorian",new Date),e.dateClicked=!0,e.callHandler(),e.close()}));this._nav_exit=d(JoomlaCalLocale.exit,"",999,"button","","js-btn btn btn-exit",{type:"button","data-action":"exit"}),this.wrapper.querySelector('[data-action="exit"]').addEventListener("click",function(a){a.preventDefault(),e.dateClicked||(e.inputField.value?("gregorian"!==e.params.dateType&&e.inputField.setAttribute("data-local-value",e.inputField.value),void 0===e.dateClicked?e.inputField.setAttribute("data-alt-value",Date.parseFieldDate(e.inputField.value,e.params.dateFormat,e.params.dateType).print(e.params.dateFormat,"gregorian",!1)):e.inputField.setAttribute("data-alt-value",e.date.print(e.params.dateFormat,"gregorian",!1))):e.inputField.setAttribute("data-alt-value","0000-00-00 00:00:00"),e.date=Date.parseFieldDate(e.inputField.getAttribute("data-alt-value"),e.params.dateFormat,e.params.dateType)),e.close()}),this.processCalendar()},t.prototype.processCalendar=function(){this.table.style.visibility="hidden";var e=this.params.firstDayOfWeek,a=this.date,t=new Date,s=t.getLocalFullYear(this.params.dateType),r=t.getLocalMonth(this.params.dateType),i=t.getLocalDate(this.params.dateType),l=a.getOtherFullYear(this.params.dateType),o=a.getHours(),n=a.getMinutes(),d=(a.getSeconds(),!this.params.time24);l<this.params.minYear?(l=this.params.minYear,a.getOtherFullYear(this.params.dateType,l)):l>this.params.maxYear&&(l=this.params.maxYear,a.getOtherFullYear(this.params.dateType,l)),this.params.firstDayOfWeek=e,this.date=new Date(a);var m=a.getLocalMonth(this.params.dateType),p=a.getLocalDate(this.params.dateType);a.setLocalDate(this.params.dateType,1);var c=(a.getLocalDay(this.params.dateType)-this.params.firstDayOfWeek)%7;c<0&&(c+=7),a.setLocalDate(this.params.dateType,-c),a.setLocalDate(this.params.dateType,a.getLocalDate(this.params.dateType)+1);for(var h=this.tbody.firstChild,u=this.ar_days=new Array,y=JoomlaCalLocale.weekend,v=parseInt(a.getLocalWeekDays(this.params.dateType)),g=0;g<v;++g,h=h.nextSibling){var b=h.firstChild;this.params.weekNumbers&&(b.className="day wn",b.innerHTML=a.getLocalWeekNumber(this.params.dateType),b=b.nextSibling),h.className=this.params.weekNumbers?"daysrow wk":"daysrow";for(var L,f=!1,C=u[g]=[],w=v+1,T=0;T<w;++T,b=b.nextSibling,a.setLocalDate(this.params.dateType,L+1)){b.className="day",b.style.textAlign="center",L=a.getLocalDate(this.params.dateType);var N=a.getLocalDay(this.params.dateType);b.pos=g<<4|T,C[T]=b;var D=a.getLocalMonth(this.params.dateType)===m;if(D)b.otherMonth=!1,f=!0,b.style.cursor="pointer";else{if(!this.params.showsOthers){b.className+=" emptycell",b.innerHTML="&#160;",b.disabled=!0;continue}b.className+=" disabled othermonth ",b.otherMonth=!0}b.disabled=!1,b.innerHTML=this.params.debug?L:Date.convertNumbers(L),b.disabled||(b.caldate=new Date(a),D&&L===p&&(b.className+=" selected",this.currentDateEl=b),a.getLocalFullYear(this.params.dateType)===s&&a.getLocalMonth(this.params.dateType)===r&&L===i&&(b.className+=" today"),-1!==y.indexOf(N)&&(b.className+=" weekend"))}f||this.params.showsOthers?h.style.display="":(h.style.display="none",h.className="emptyrow")}if(this.params.showsTime){o>12&&d&&(o-=12),o=o<10?"0"+o:o,n=n<10?"0"+n:n;var F=this.table.querySelector(".time-hours"),k=this.table.querySelector(".time-minutes");if(this.resetSelected(F),this.params.time24?F.value=o:F.value="00"==o?"12":o,this.resetSelected(k),k.value=n,!this.params.time24){var J=new Date(this.inputField.getAttribute("data-alt-value")),A=this.table.querySelector(".time-ampm");J.getHours()>12&&(this.resetSelected(A),A.value="pm")}}if(this.params.compressedHeader){var M=Date.convertNumbers(l.toString());this._nav_month.getElementsByTagName("span")[0].innerHTML=this.params.monthBefore?M+" - "+JoomlaCalLocale.months[m]:JoomlaCalLocale.months[m]+" - "+M}else this._nav_month.getElementsByTagName("span")[0].innerHTML=this.params.debug?m+" "+JoomlaCalLocale.months[m]:JoomlaCalLocale.months[m],this.title.getElementsByTagName("span")[0].innerHTML=this.params.debug?l+" "+Date.convertNumbers(l.toString()):Date.convertNumbers(l.toString());this.table.style.visibility="visible"},t.prototype._bindEvents=function(){var e=this;this.inputField.addEventListener("blur",function(a){var s=t.getCalObject(this)._joomlaCalendar;if("block"!==s.dropdownElement.style.display){if(s){if(s.inputField.value)if(void 0===s.params.dateClicked)if(s.inputField.setAttribute("data-local-value",s.inputField.value),"gregorian"!==s.params.dateType){var r,i=Date.parseFieldDate(s.inputField.value,s.params.dateFormat,s.params.dateType);r=Date.localCalToGregorian(i.getFullYear(),i.getMonth(),i.getDate()),i.setFullYear(r[0]),i.setMonth(r[1]),i.setDate(r[2]),s.inputField.setAttribute("data-alt-value",i.print(s.params.dateFormat,"gregorian",!1))}else s.inputField.setAttribute("data-alt-value",Date.parseFieldDate(s.inputField.value,s.params.dateFormat,s.params.dateType).print(s.params.dateFormat,"gregorian",!1));else s.inputField.setAttribute("data-alt-value",s.date.print(s.params.dateFormat,"gregorian",!1));else s.inputField.setAttribute("data-alt-value","0000-00-00 00:00:00");s.date=Date.parseFieldDate(s.inputField.getAttribute("data-alt-value"),s.params.dateFormat,s.params.dateType)}e.close()}else a.preventDefault()},!0),this.button.addEventListener("click",function(){e.show()},!1)};var s=function(a){return a||(a=e.event),a.preventDefault(),a.stopPropagation(),!1},r=function(e,t){var s;return s=a.createElement(e),void 0!==t&&t.appendChild(s),s},i=function(e){return!isNaN(e)&&(0|(a=parseFloat(e)))===a;var a},l=function(e,a){return(new Date).getLocalFullYear(a)+e};function o(e){for(var a=e.target.querySelectorAll(".field-calendar"),s=0,r=a.length;s<r;s++)t.init(a[s])}t.getCalObject=function(e){if(!e)return!1;for(;e.parentNode;)if((e=e.parentNode).classList.contains("field-calendar"))return e;return!1},t.prototype.setAltValue=function(){var e=this.inputField;e.getAttribute("disabled")||(e.value=e.getAttribute("data-alt-value")?e.getAttribute("data-alt-value"):"")},t.onSubmit=function(){if(Joomla=e.Joomla||{},!Joomla.calendarProcessed){Joomla.calendarProcessed=!0;for(var t=a.querySelectorAll(".field-calendar"),s=0;s<t.length;s++){var r=t[s]._joomlaCalendar;r&&r.setAltValue()}}},t.init=function(a,s){e.JoomlaCalLocale=e.JoomlaCalLocale?JoomlaCalLocale:{},JoomlaCalLocale.today=JoomlaCalLocale.today?JoomlaCalLocale.today:"today",JoomlaCalLocale.weekend=JoomlaCalLocale.weekend?JoomlaCalLocale.weekend:[0,6],JoomlaCalLocale.localLangNumbers=JoomlaCalLocale.localLangNumbers?JoomlaCalLocale.localLangNumbers:[0,1,2,3,4,5,6,7,8,9],JoomlaCalLocale.wk=JoomlaCalLocale.wk?JoomlaCalLocale.wk:"wk",JoomlaCalLocale.AM=JoomlaCalLocale.AM?JoomlaCalLocale.AM:"AM",JoomlaCalLocale.PM=JoomlaCalLocale.PM?JoomlaCalLocale.PM:"PM",JoomlaCalLocale.am=JoomlaCalLocale.am?JoomlaCalLocale.am:"am",JoomlaCalLocale.pm=JoomlaCalLocale.pm?JoomlaCalLocale.pm:"pm",JoomlaCalLocale.dateType=JoomlaCalLocale.dateType?JoomlaCalLocale.dateType:"gregorian",JoomlaCalLocale.time=JoomlaCalLocale.time?JoomlaCalLocale.time:"time",JoomlaCalLocale.days=JoomlaCalLocale.days?JoomlaCalLocale.days:'["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday"]',JoomlaCalLocale.shortDays=JoomlaCalLocale.shortDays?JoomlaCalLocale.shortDays:["Sun","Mon","Tue","Wed","Thu","Fri","Sat","Sun"],JoomlaCalLocale.months=JoomlaCalLocale.months?JoomlaCalLocale.months:["January","February","March","April","May","June","July","August","September","October","November","December"],JoomlaCalLocale.shortMonths=JoomlaCalLocale.shortMonths?JoomlaCalLocale.shortMonths:["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"],JoomlaCalLocale.minYear=JoomlaCalLocale.minYear?JoomlaCalLocale.minYear:1900,JoomlaCalLocale.maxYear=JoomlaCalLocale.maxYear?JoomlaCalLocale.maxYear:2100,JoomlaCalLocale.exit=JoomlaCalLocale.exit?JoomlaCalLocale.exit:"Cancel",JoomlaCalLocale.clear=JoomlaCalLocale.clear?JoomlaCalLocale.clear:"Clear";var r=a._joomlaCalendar;r?r.recreate():new t(a),a&&a.getElementsByTagName("input")[0]&&a.getElementsByTagName("input")[0].form&&!a.getElementsByTagName("input")[0].disabled&&a.getElementsByTagName("input")[0].form.addEventListener("submit",t.onSubmit)},e.JoomlaCalendar=t,a.addEventListener("DOMContentLoaded",o),a.addEventListener("joomla:updated",o),e.Calendar={},Calendar.setup=function(e){if(e.inputField&&a.getElementById(e.inputField)){var s=a.getElementById(e.inputField),r=s.parentNode.querySelectorAll("button")[0];for(var i in e)if(e.hasOwnProperty(i))switch(i){case"ifFormat":r&&r.setAttribute("data-dayformat",e.ifFormat);break;case"firstDay":r&&r.setAttribute("data-firstday",parseInt(e.firstDay));break;case"weekNumbers":r&&r.setAttribute("data-week-numbers","true"===e.weekNumbers||!0===e.weekNumbers?"1":"0");break;case"showOthers":r&&r.setAttribute("data-show-others","true"===e.showOthers||!0===e.showOthers?"1":"0");break;case"showsTime":r&&r.setAttribute("data-show-time","true"===e.showsTime||!0===e.showsTime?"1":"0");break;case"timeFormat":r&&r.setAttribute("data-time-24",parseInt(e.timeFormat))}t.init(s.parentNode.parentNode)}return null}}(window,document);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in joomla-field-media-es5.min.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-media-es5.min.js:1
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- !function(){return function t(e,i,n){function r(u,s){if(!i[u]){if(!e[u]){var a="function"==typeof require&&require;if(!s&&a)return a(u,!0);if(o)return o(u,!0);var l=new Error("Cannot find module '"+u+"'");throw l.code="MODULE_NOT_FOUND",l}var c=i[u]={exports:{}};e[u][0].call(c.exports,function(t){return r(e[u][1][t]||t)},c,c.exports,t,e,i,n)}return i[u].exports}for(var o="function"==typeof require&&require,u=0;u<n.length;u++)r(n[u]);return r}}()({1:[function(t,e,i){"use strict";var n=function(){function t(t,e){for(var i=0;i<e.length;i++){var n=e[i];n.enumerable=n.enumerable||!1,n.configurable=!0,"value"in n&&(n.writable=!0),Object.defineProperty(t,n.key,n)}}return function(e,i,n){return i&&t(e.prototype,i),n&&t(e,n),e}}(),r="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t};!function(t,e){if(!e)throw new Error("Joomla API is not properly initiated");e.selectedFile={},window.document.addEventListener("onMediaFileSelected",function(t){e.selectedFile=t.detail}),e.doIt=function(t,i,n){if(!0===t.success){if(t.data[0].url)if(/local-/.test(t.data[0].adapter)){var o=e.getOptions("system.paths").rootFull;e.selectedFile.url=t.data[0].url.split(o)[1],t.data[0].thumb_path?e.selectedFile.thumb=t.data[0].thumb_path:e.selectedFile.thumb=!1}else t.data[0].thumb_path&&(e.selectedFile.thumb=t.data[0].thumb_path);else e.selectedFile.url=!1;var u=function(t){return"object"===("undefined"==typeof HTMLElement?"undefined":r(HTMLElement))?t instanceof HTMLElement:t&&"object"===(void 0===t?"undefined":r(t))&&null!==t&&1===t.nodeType&&"string"==typeof t.nodeName};e.selectedFile.url&&(u(i)||"object"===(void 0===i?"undefined":r(i))?!u(i)&&"object"===(void 0===i?"undefined":r(i))&&i.id?window.parent.Joomla.editors.instances[i.id].replaceSelection('<img src="'+e.selectedFile.url+'" alt=""/>'):(i.value=e.selectedFile.url,n.updatePreview()):e.editors.instances[i].replaceSelection('<img src="'+e.selectedFile.url+'" alt=""/>'))}},e.getImage=function(t,i,n){return new Promise(function(r,o){var u=e.getOptions("system.paths").rootFull+"administrator/index.php?option=com_media&format=json";e.request({url:u+"&task=api.files&url=true&path="+t.path+"&"+e.getOptions("csrf.token")+"=1&format=json",method:"GET",perform:!0,headers:{"Content-Type":"application/json"},onSuccess:function(t){var o=JSON.parse(t);r(e.doIt(o,i,n))},onError:function(){o()}})})};var i=function(t){function i(){return function(t,e){if(!(t instanceof e))throw new TypeError("Cannot call a class as a function")}(this,i),function(t,e){if(!t)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!e||"object"!=typeof e&&"function"!=typeof e?t:e}(this,(i.__proto__||Object.getPrototypeOf(i)).apply(this,arguments))}return function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Super expression must either be null or a function, not "+typeof e);t.prototype=Object.create(e&&e.prototype,{constructor:{value:t,enumerable:!1,writable:!0,configurable:!0}}),e&&(Object.setPrototypeOf?Object.setPrototypeOf(t,e):t.__proto__=e)}(i,HTMLElement),n(i,[{key:"connectedCallback",value:function(){var t=this.querySelector(this.buttonSelect),e=this.querySelector(this.buttonClear);this.show=this.show.bind(this),this.modalClose=this.modalClose.bind(this),this.clearValue=this.clearValue.bind(this),this.setValue=this.setValue.bind(this),this.updatePreview=this.updatePreview.bind(this),t.addEventListener("click",this.show),e&&e.addEventListener("click",this.clearValue),this.updatePreview()}},{key:"disconnectedCallback",value:function(){this.querySelector(this.buttonClear).removeEventListener("click",this)}},{key:"show",value:function(){var t=this,e=this;this.querySelector('[role="dialog"]').open(),this.querySelector(this.buttonSaveSelected).addEventListener("click",function(i){return i.preventDefault(),i.stopPropagation(),t.selectedPath&&e.setValue(t.selectedPath),e.modalClose(),!1})}},{key:"modalClose",value:function(){var t=this.querySelector(this.input);e.getImage(e.selectedFile,t,this),e.Modal.getCurrent().close()}},{key:"setValue",value:function(t){this.querySelector(this.input).value=t,this.updatePreview()}},{key:"clearValue",value:function(){this.setValue("")}},{key:"updatePreview",value:function(){if(-1!==["true","static"].indexOf(this.preview)&&"false"!==this.preview&&this.preview){var t=this.querySelector(this.input).value,i=this.querySelector(".field-media-preview");if(t){i.innerHTML="";var n=new Image;switch(this.type){case"image":n.src=n.src=/http/.test(t)?t:e.getOptions("system.paths").rootFull+t}i.style.width=this.previewWidth,i.appendChild(n)}else i.innerHTML='<span class="field-media-preview-icon fa fa-picture-o"></span>'}}},{key:"type",get:function(){return this.getAttribute("type")},set:function(t){this.setAttribute("type",t)}},{key:"basePath",get:function(){return this.getAttribute("base-path")},set:function(t){this.setAttribute("base-path",t)}},{key:"rootFolder",get:function(){return this.getAttribute("root-folder")},set:function(t){this.setAttribute("root-folder",t)}},{key:"url",get:function(){return this.getAttribute("url")},set:function(t){this.setAttribute("url",t)}},{key:"modalContainer",get:function(){return this.getAttribute("modal-container")},set:function(t){this.setAttribute("modal-container",t)}},{key:"input",get:function(){return this.getAttribute("input")},set:function(t){this.setAttribute("input",t)}},{key:"buttonSelect",get:function(){return this.getAttribute("button-select")},set:function(t){this.setAttribute("button-select",t)}},{key:"buttonClear",get:function(){return this.getAttribute("button-clear")},set:function(t){this.setAttribute("button-clear",t)}},{key:"buttonSaveSelected",get:function(){return this.getAttribute("button-save-selected")},set:function(t){this.setAttribute("button-save-selected",t)}},{key:"modalWidth",get:function(){return this.getAttribute(parseInt("modal-width",10))},set:function(t){this.setAttribute("modal-width",t)}},{key:"modalHeight",get:function(){return this.getAttribute(parseInt("modal-height",10))},set:function(t){this.setAttribute("modal-height",t)}},{key:"previewWidth",get:function(){return this.getAttribute(parseInt("preview-width",10))},set:function(t){this.setAttribute("preview-width",t)}},{key:"previewHeight",get:function(){return this.getAttribute(parseInt("preview-height",10))},set:function(t){this.setAttribute("preview-height",t)}},{key:"preview",get:function(){return this.getAttribute("preview")},set:function(t){this.setAttribute("preview",t)}},{key:"previewContainer",get:function(){return this.getAttribute("preview-container")}}],[{key:"observedAttributes",get:function(){return["type","base-path","root-folder","url","modal-container","modal-width","modal-height","input","button-select","button-clear","button-save-selected","preview","preview-width","preview-height"]}}]),i}();t.define("joomla-field-media",i)}(customElements,Joomla)},{}]},{},[1]);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L186

Insecure DOM Manipulation (XSS) in joomla-field-media.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-media.js:186
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- div.innerHTML = '<span class="field-media-preview-icon fa fa-picture-o"></span>';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L93

Insecure DOM Manipulation (XSS) in joomla-field-module-order-es5.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-module-order-es5.js:93
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- node.innerHTML = item[2];
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L218

Insecure DOM Manipulation (XSS) in joomla-field-simple-color.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-simple-color.js:218
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- close.innerHTML = this.textClose;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L80

Insecure DOM Manipulation (XSS) in joomla-field-subform-es5.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-subform-es5.js:80
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- var b = this.getRows().length;if (b >= this.maximum) return null;var c;c = 'TBODY' === this.containerWithRows.nodeName || 'TABLE' === this.containerWithRows.nodeName ? document.createElement('tbody') : document.createElement('div'), c.innerHTML = this.template;var d = c.children[0];return a ? a.parentNode.insertBefore(d, a.nextSibling) : this.containerWithRows.append(d), this.buttonMove && (d.setAttribute('draggable', 'false'), d.setAttribute('aria-grabbed', 'false'), d.setAttribute('tabindex', '0')), d.setAttribute('data-new', '1'), this.fixUniqueAttributes(d, b), this.dispatchEvent(new CustomEvent('subform-row-add', { detail: { row: d }, bubbles: !0 })), window.Joomla && Joomla.Event.dispatch(d, 'joomla:updated'), d;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L54

Insecure DOM Manipulation (XSS) in joomla-hidden-mail-es5.js

CWE-79
File Location: media/system/webcomponents/js/joomla-hidden-mail-es5.js:54
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- newEl.innerHTML = innerStr;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L48

Insecure DOM Manipulation (XSS) in incompatible.js

CWE-79
File Location: build/incompatible_page/incompatible.js:48
Security Score:
72 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- header.innerHTML = errorLocale[key].header;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L72

Insecure DOM Manipulation (XSS) in field-module-order.js

CWE-79
File Location: build/media/webcomponents/js/field-module-order/field-module-order.js:72
Security Score:
72 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- node.innerHTML = item[2];
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in associations-edit.es6.min.js

CWE-79
File Location: media/com_associations/js/associations-edit.es6.min.js:1
Security Score:
72 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- Joomla=window.Joomla||{},((e,o)=>{"use strict";e.hideAssociation=((e,s)=>{[].slice.call(o.querySelectorAll("#associations .control-group")).forEach(o=>{const t=o.querySelector(".control-label label");if(t){t.getAttribute("for").replace("_id","")===`${e}_associations_${s.replace("-","_")}`&&(o.style.display="none")}})}),e.showAssociationMessage=(()=>{[].slice.call(o.querySelectorAll("#associations .control-group")).forEach(s=>{s.style.display="none";const t=o.getElementById("associations");if(t){const s=o.createElement("div");s.classList.add("alert"),s.classList.add("alert-info"),s.id="associations-notice",s.innerHTML=e.JText._("JGLOBAL_ASSOC_NOT_POSSIBLE"),t.insertAdjacentElement("afterbegin",s)}})}),o.addEventListener("DOMContentLoaded",()=>{const s=e.getOptions("system.associations.edit"),t=s.formControl||"jform",a=o.getElementById(`${t}_language`);1===parseInt(s.hidden,10)?e.showAssociationMessage():a&&e.hideAssociation(t,a.value),a&&a.addEventListener("change",s=>{e.removeMessages();let a=!1;[].slice.call(o.querySelectorAll("#associations .control-group")).forEach(e=>{const s=e.querySelector(".control-label label").getAttribute("for").replace("_id","").replace("jform_associations_","");e.style.display="block",a||""===o.getElementById(`${t}_associations_${s}_id`).value||(a=!0);const i=o.getElementById(`${t}_associations_${s}_clear`);i.onclick?i.onclick():i.click&&i.click()}),a&&e.renderMessages({warning:[e.JText._("JGLOBAL_ASSOCIATIONS_RESET_WARNING")]});const i=s.target.value;"*"===i?e.showAssociationMessage():e.hideAssociation(t,i)})})})(Joomla,document);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L357

Insecure DOM Manipulation (XSS) in client.js

CWE-79
File Location: media/plg_installer_webinstaller/js/client.js:357
Security Score:
72 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- nameElement.innerHTML = name;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L766

Insecure DOM Manipulation (XSS) in calendar.js

CWE-79
File Location: media/system/js/fields/calendar.js:766
Security Score:
72 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- cell.innerHTML = "&#160;";
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L368

Insecure DOM Manipulation (XSS) in searchtools.js

CWE-79
File Location: media/system/js/searchtools.js:368
Security Score:
72 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- self.orderFieldName.innerHTML += $option;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L89

Insecure DOM Manipulation (XSS) in joomla-field-user.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-user.js:89
Security Score:
72 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- this.modalBody.innerHTML = '';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in joomla-hidden-mail-es5.min.js

CWE-79
File Location: media/system/webcomponents/js/joomla-hidden-mail-es5.min.js:1
Security Score:
72 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- !function(){return function t(e,r,n){function i(u,a){if(!r[u]){if(!e[u]){var c="function"==typeof require&&require;if(!a&&c)return c(u,!0);if(o)return o(u,!0);var s=new Error("Cannot find module '"+u+"'");throw s.code="MODULE_NOT_FOUND",s}var f=r[u]={exports:{}};e[u][0].call(f.exports,function(t){return i(e[u][1][t]||t)},f,f.exports,t,e,r,n)}return r[u].exports}for(var o="function"==typeof require&&require,u=0;u<n.length;u++)i(n[u]);return i}}()({1:[function(t,e,r){"use strict";var n=function(){function t(t,e){for(var r=0;r<e.length;r++){var n=e[r];n.enumerable=n.enumerable||!1,n.configurable=!0,"value"in n&&(n.writable=!0),Object.defineProperty(t,n.key,n)}}return function(e,r,n){return r&&t(e.prototype,r),n&&t(e,n),e}}();customElements.define("joomla-hidden-mail",function(t){function e(){return function(t,e){if(!(t instanceof e))throw new TypeError("Cannot call a class as a function")}(this,e),function(t,e){if(!t)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!e||"object"!=typeof e&&"function"!=typeof e?t:e}(this,(e.__proto__||Object.getPrototypeOf(e)).apply(this,arguments))}return function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Super expression must either be null or a function, not "+typeof e);t.prototype=Object.create(e&&e.prototype,{constructor:{value:t,enumerable:!1,writable:!0,configurable:!0}}),e&&(Object.setPrototypeOf?Object.setPrototypeOf(t,e):t.__proto__=e)}(e,HTMLElement),n(e,[{key:"connectedCallback",value:function(){var t=void 0,e=this.getAttribute("base")+"/";if("1"===this.getAttribute("is-link")){(t=document.createElement("a")).setAttribute("href","mailto:"+this.b64DecodeUnicode(this.getAttribute("first"))+"@"+this.b64DecodeUnicode(this.getAttribute("last")));for(var r=0,n=this.attributes.length;r<n;++r){var i=this.attributes.item(r).nodeName;if(i){if(["is-link","is-email","first","last","text"].indexOf(i)>-1)continue;var o=this.attributes.item(r).nodeValue;t.setAttribute(i,o)}}}else t=document.createElement("span");if(this.getAttribute("text")){var u=this.b64DecodeUnicode(this.getAttribute("text"));u=u.replace('src="images/','src="'+e+"images/").replace('src="media/','src="'+e+"media/"),t.innerHTML=u}else t.innerText=window.atob(this.getAttribute("first"))+"@"+window.atob(this.getAttribute("last"));this.innerText="",this.appendChild(t)}},{key:"b64DecodeUnicode",value:function(t){return decodeURIComponent(Array.prototype.map.call(atob(t),function(t){return"%"+("00"+t.charCodeAt(0).toString(16)).slice(-2)}).join(""))}}]),e}())},{}]},{},[1]);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L240

Insecure DOM Manipulation (XSS) in field-simple-color.js

CWE-79
File Location: build/media/webcomponents/js/field-simple-color/field-simple-color.js:240
Security Score:
71 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- this.icon.innerHTML = '<span class="sr-only">' + this.textSelect + '</span>';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L82

Insecure DOM Manipulation (XSS) in indexer.js

CWE-79
File Location: media/com_finder/js/indexer.js:82
Security Score:
71 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- progressMessage.innerHTML = json.message;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L55

Insecure DOM Manipulation (XSS) in admin-module-edit.js

CWE-79
File Location: media/com_modules/js/admin-module-edit.js:55
Security Score:
71 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- tmpMenu.innerHTML = '<span class=\"badge badge-info\">' + Joomla.JText._('JALL') + '</span>';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in helpsite.min.js

CWE-79
File Location: media/legacy/js/helpsite.min.js:1
Security Score:
71 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- "use strict";var resetHelpSiteList=function(){var e=this.getAttribute("rel"),t=this.getAttribute("showDefault");Joomla.request({url:"index.php?option=com_users&task=profile.gethelpsites&format=json",method:"GET",data:"",perform:!0,headers:{"Content-Type":"application/json;charset=utf-8"},onSuccess:function(n,o){var r;n=JSON.parse(n),document.getElementById(e).innerHTML="",n.data.forEach(function(n){""===n.value&&"true"!==t||((r=document.createElement("option")).value=n.value,r.innerHTML=n.text,document.getElementById(e).appendChild(r))})},onError:function(e){Joomla.removeMessages(),Joomla.renderMessages(Joomla.ajaxErrorsMessages(e))}})};document.addEventListener("DOMContentLoaded",function(){document.getElementById("helpsite-refresh").addEventListener("click",resetHelpSiteList)});
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in client.es6.min.js

CWE-79
File Location: media/plg_installer_webinstaller/js/client.es6.min.js:1
Security Score:
71 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- if(!window.jQuery)throw new Error("WebInstaller plugin requires jQuery");if(!Joomla)throw new Error("Joomla API is not properly initialised");((e,t,i,l)=>{"use strict";const n={view:"dashboard",id:0,ordering:"",list:0,options:i.getOptions("plg_installer_webinstaller",{})};let s;class a{initialise(){if(n.loaded=1,t.getElementById("myTabContent")){const e=t.getElementById("web");t.getElementById("uploadform-web-cancel").addEventListener("click",()=>{t.getElementById("uploadform-web").classList.add("hidden"),n.list&&t.querySelector(".list-view")&&t.querySelector(".list-view").click()}),e.insertAdjacentHTML("afterbegin",'<div id="appsloading" class="ifw-loading-container"></div>'),e.style.position="absolute",l("#appsloading").on("ajaxStart",()=>{t.body.classList.add("ifw-busy"),t.getElementById("appsloading").classList.remove("hidden")}).on("ajaxStop",()=>{t.getElementById("appsloading").classList.add("hidden"),t.body.classList.remove("ifw-busy")})}this.loadweb(`${n.options.base_url}index.php?format=json&option=com_apps&view=dashboard`),this.clickforlinks()}loadweb(s){if(!s)return!1;const r=this,o=new RegExp(n.options.base_url),d=new RegExp("^index.php");if(!o.test(s)&&!d.test(s))return e.open(s,"_blank"),!1;let c=`${s}&product=${n.options.product}&release=${n.options.release}&dev_level=${n.options.dev_level}&list=${n.list?"list":"grid"}&lang=${n.options.language}`;if(""!==n.ordering&&t.getElementById("com-apps-ordering").value&&(n.ordering=t.getElementById("com-apps-ordering").value,c+=`&ordering=${n.ordering}`),t.getElementById("myTabContent")){const e=t.getElementById("appsloading");e.style.position="absolute",e.style.left="0",e.style.top="0",e.style.width="100%",e.style.height="100%";const i=t.getElementById("web");i.style.position="relative",i.appendChild(e),l("#appsloading").trigger("ajaxStart")}return l.ajax({url:c,dataType:"jsonp",cache:!0,jsonpCallback:"jedapps_jsonpcallback",timeout:2e4,success(e){t.getElementById("web-loader")&&t.getElementById("web-loader").classList.add("hidden"),t.getElementById("jed-container").innerHTML=e.data.html,t.getElementById("com-apps-searchbox").addEventListener("keypress",e=>{13===e.which&&r.initiateSearch()}),t.getElementById("search-extensions").addEventListener("click",()=>{r.initiateSearch()}),t.getElementById("search-reset").addEventListener("click",()=>{t.getElementById("com-apps-searchbox").value="",r.initiateSearch()});const i=t.getElementById("com-apps-ordering");i&&i.addEventListener("change",()=>{const e=i.selectedIndex;n.ordering=i.options[e].value,r.installfromwebajaxsubmit()}),""!==n.options.installfrom_url&&r.installfromweb(n.options.installfrom_url)},fail(){t.getElementById("web-loader")&&(t.getElementById("web-loader").classList.add("hidden"),t.getElementById("web-loader-error").classList.remove("hidden"))},complete(){const s=t.getElementById("joomlaapsinstallatinput");if(s&&(s.value=n.options.installat_url),r.clickforlinks(),a.clicker(),"extension"!==n.view&&[].slice.call(t.querySelectorAll("div.load-extension")).forEach(e=>{e.addEventListener("click",t=>{t.preventDefault(),r.processLinkClick(e.getAttribute("data-url"))}),e.setAttribute("href","#")}),"extension"===n.view){const l=t.getElementById("install-extension"),n=t.getElementById("install-extension-from-external");l&&l.addEventListener("click",()=>{r.installfromweb(l.getAttribute("data-downloadurl"),l.getAttribute("data-name"))}),n&&n.addEventListener("click",()=>{const l=n.getAttribute("data-downloadurl");!0===e.confirm(i.JText._("PLG_INSTALLER_WEBINSTALLER_REDIRECT_TO_EXTERNAL_SITE_TO_INSTALL").replace("[SITEURL]",l))&&(t.getElementById("adminForm").setAttribute("action",l),t.querySelector("input[name=task]").setAttribute("disabled",!0),t.querySelector("input[name=install_directory]").setAttribute("disabled",!0),t.querySelector("input[name=install_url]").setAttribute("disabled",!0),t.querySelector("input[name=installtype]").setAttribute("disabled",!0),t.querySelector("input[name=filter_search]").setAttribute("disabled",!0),t.getElementById("adminForm").submit())})}n.list&&t.querySelector(".list-view")&&t.querySelector(".list-view").click(),t.getElementById("myTabContent")&&l("#appsloading").trigger("ajaxStop")},error(e){const i=t.getElementById("web-loader-error"),l=t.getElementById("web-loader");e.responseText&&i&&(i.innerHTML=e.responseText),l&&(l.classList.add("hidden"),i.classList.remove("hidden"))}}),!0}clickforlinks(){const e=this;[].slice.call(t.querySelectorAll("a.transcode")).forEach(t=>{const i=t.getAttribute("href");t.addEventListener("click",t=>{t.preventDefault(),e.processLinkClick(i)}),t.setAttribute("href","#")})}initiateSearch(){n.view="dashboard",this.installfromwebajaxsubmit()}installfromwebajaxsubmit(){let e=`&view=${n.view}`;if(n.id&&(e+=`&id=${n.id}`),t.getElementById("com-apps-searchbox").value){e+=`&filter_search=${encodeURI(t.getElementById("com-apps-searchbox").value.toLowerCase().replace(/ +/g,"_").replace(/[^a-z0-9-_]/g,"").trim())}`}""!==n.ordering&&t.getElementById("com-apps-ordering").value&&(n.ordering=t.getElementById("com-apps-ordering").value),n.ordering&&(e+=`&ordering=${n.ordering}`),this.loadweb(`${n.options.base_url}index.php?format=json&option=com_apps${e}`)}processLinkClick(e){const t=new RegExp(n.options.base_url),i=new RegExp("^index.php");t.test(e)||i.test(e)?(n.view=e.replace(/^.+[&?]view=(\w+).*$/,"$1"),"dashboard"===n.view?n.id=0:"category"===n.view&&(n.id=e.replace(/^.+[&?]id=(\d+).*$/,"$1")),this.loadweb(n.options.base_url+e)):this.loadweb(e)}static clicker(){t.querySelector(".grid-view")&&t.querySelector(".grid-view").addEventListener("click",()=>{n.list=0,t.querySelector(".list-container").classList.add("hidden"),t.querySelector(".grid-container").classList.remove("hidden"),t.getElementById("btn-list-view").classList.remove("active"),t.getElementById("btn-grid-view").classList.remove("active")}),t.querySelector(".list-view")&&t.querySelector(".list-view").addEventListener("click",()=>{n.list=1,t.querySelector(".grid-container").classList.add("hidden"),t.querySelector(".list-container").classList.remove("hidden"),t.getElementById("btn-grid-view").classList.remove("active"),t.getElementById("btn-list-view").classList.add("active")})}static installfromweb(e,l){if(!e)return alert(i.JText._("PLG_INSTALLER_WEBINSTALLER_CANNOT_INSTALL_EXTENSION_IN_PLUGIN")),!1;const n=t.getElementById("install_url"),s=t.getElementById("uploadform-web-url");if(n.value=e,s.innerHTML=e,l){t.getElementById("uploadform-web-name").innerHTML=l,t.getElementById("uploadform-web-name-label").classList.remove("hidden")}else t.getElementById("uploadform-web-name-label").classList.add("hidden");return t.getElementById("uploadform-web").classList.remove("hidden"),!0}}l(e=>{const t=e("#myTabTabs").find('a[href="#web"]');n.options.installfromon&&t.click(),t.hasClass("active")&&(s||(s=new a).initialise()),t.closest("li").click(()=>{s||(s=new a).initialise()}),""!==n.options.installfrom_url&&t.closest("li").click(),t.on("shown.bs.tab",()=>{s||(s=new a).initialise()})})})(window,document,Joomla,window.jQuery);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L612

Insecure DOM Manipulation (XSS) in calendar.js

CWE-79
File Location: media/system/js/fields/calendar.js:612
Security Score:
71 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- cell.innerHTML = cs ? "<div unselectable='on'" + classes + ">" + text + "</div>" : text;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L896

Insecure DOM Manipulation (XSS) in calendar.js

CWE-79
File Location: media/system/js/fields/calendar.js:896
Security Score:
71 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- cell.innerHTML = date.getLocalWeekNumber(this.params.dateType); //date.convertNumbers();
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in passwordstrength.min.js

CWE-79
File Location: media/system/js/fields/passwordstrength.min.js:1
Security Score:
71 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- "use strict";var PasswordStrength;PasswordStrength=function(){function e(e){this.lowercase=e.lowercase||0,this.uppercase=e.uppercase||0,this.numbers=e.numbers||0,this.special=e.special||0,this.length=e.length||4}return e.prototype.getScore=function(e){for(var t=0,r=0,s=["lowercase","uppercase","numbers","special","length"],a=0,n=s.length;n>a;a++)this.hasOwnProperty(s[a])&&this[s[a]]>0&&(r+=1);return t+=this.calc(e,/[a-z]/g,this.lowercase,r),t+=this.calc(e,/[A-Z]/g,this.uppercase,r),t+=this.calc(e,/[0-9]/g,this.numbers,r),t+=this.calc(e,/[\$\!\#\?\=\;\:\*\-\_\€\%\&\(\)\`\´]/g,this.special,r),t+=1==r?e.length>this.length?100:100/this.length*e.length:e.length>this.length?100/r:100/r/this.length*e.length},e.prototype.calc=function(e,t,r,s){var a;return(a=e.match(t))&&a.length>r&&0!=r?100/s:a&&r>0?100/s/r*a.length:0},e}(),document.addEventListener("DOMContentLoaded",function(){for(var e=document.querySelectorAll(".js-password-strength"),t=0,r=e.length;t<r;t++){var s="",a="";e[t].value.length||(s=" bg-danger",a=0);var n=document.createElement("div");n.setAttribute("class","progress");var i=document.createElement("div");i.setAttribute("class","progress-bar progress-bar-striped progress-bar-animated"+s),i.style.width=0+a,i.max=100,i.setAttribute("aria-describedby","password-"+t),n.appendChild(i);var o=document.createElement("div");o.setAttribute("class","text-xs-center"),o.setAttribute("id","password-"+t),e[t].parentNode.insertAdjacentElement("afterEnd",o),e[t].parentNode.insertAdjacentElement("afterEnd",n),e[t].value.length>0&&e[t].setAttribute("required",!0),e[t].addEventListener("keyup",function(e){var t,r,s,a,n,i,o,g,l,c;t=e.target,r=t.getAttribute("data-min-length"),s=t.getAttribute("data-min-integers"),a=t.getAttribute("data-min-symbols"),n=t.getAttribute("data-min-uppercase"),i=t.getAttribute("data-min-lowercase"),o=document.querySelector(".progress-bar"),g=new PasswordStrength({lowercase:i||0,uppercase:n||0,numbers:s||0,special:a||0,length:r||4}).getScore(t.value),l=o.getAttribute("aria-describedby").replace(/^\D+/g,""),c=t.parentNode.parentNode.querySelector("#password-"+l),g>79&&(o.setAttribute("class","progress-bar progress-bar-striped progress-bar-animated bg-warning"),c.innerHTML=Joomla.JText._("JFIELD_PASSWORD_INDICATE_COMPLETE")),g>64&&g<80&&(o.setAttribute("class","progress-bar progress-bar-striped progress-bar-animated bg-warning"),c.innerHTML=Joomla.JText._("JFIELD_PASSWORD_INDICATE_INCOMPLETE")),g>50&&g<65&&(o.setAttribute("class","progress-bar progress-bar-striped progress-bar-animated bg-warning"),c.innerHTML=Joomla.JText._("JFIELD_PASSWORD_INDICATE_INCOMPLETE")),g>40&&g<51&&(o.setAttribute("class","progress-bar progress-bar-striped progress-bar-animated bg-warning"),c.innerHTML=Joomla.JText._("JFIELD_PASSWORD_INDICATE_INCOMPLETE")),g<41&&(o.setAttribute("class","progress-bar progress-bar-striped progress-bar-animated bg-danger"),c.innerHTML=Joomla.JText._("JFIELD_PASSWORD_INDICATE_INCOMPLETE")),100===g&&o.setAttribute("class","progress-bar progress-bar-striped progress-bar-animated bg-success"),o.style.width=g+"%",t.value.length||(o.setAttribute("class","progress-bar progress-bar-striped progress-bar-animated"),c.innerHTML="",t.setAttribute("required",""))})}e[0]&&document.formvalidator.setHandler("password-strength",function(e){var t=!1,r=document.querySelectorAll(".js-password-strength"),s=r[0].getAttribute("data-min-length"),a=r[0].getAttribute("data-min-integers"),n=r[0].getAttribute("data-min-symbols"),i=r[0].getAttribute("data-min-uppercase"),o=r[0].getAttribute("data-min-lowercase");return 100===new PasswordStrength({lowercase:o||0,uppercase:i||0,numbers:a||0,special:n||0,length:s||4}).getScore(e)&&(t=!0),t})});
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L103

Insecure DOM Manipulation (XSS) in joomla-field-module-order-es5.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-module-order-es5.js:103
Security Score:
71 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- this.innerHTML = '';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L229

Insecure DOM Manipulation (XSS) in joomla-field-simple-color-es5.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-simple-color-es5.js:229
Security Score:
71 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- el.innerHTML = '<span class="sr-only">' + a11yColor + '</span>';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in joomla-field-switcher-es5.min.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-switcher-es5.min.js:1
Security Score:
71 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- !function(){return function t(e,i,n){function s(a,c){if(!i[a]){if(!e[a]){var o="function"==typeof require&&require;if(!c&&o)return o(a,!0);if(r)return r(a,!0);var u=new Error("Cannot find module '"+a+"'");throw u.code="MODULE_NOT_FOUND",u}var h=i[a]={exports:{}};e[a][0].call(h.exports,function(t){return s(e[a][1][t]||t)},h,h.exports,t,e,i,n)}return i[a].exports}for(var r="function"==typeof require&&require,a=0;a<n.length;a++)s(n[a]);return s}}()({1:[function(t,e,i){"use strict";var n=function(){function t(t,e){for(var i=0;i<e.length;i++){var n=e[i];n.enumerable=n.enumerable||!1,n.configurable=!0,"value"in n&&(n.writable=!0),Object.defineProperty(t,n.key,n)}}return function(e,i,n){return i&&t(e.prototype,i),n&&t(e,n),e}}();!function(t){var e=13,i=32,s=function(t){function s(){!function(t,e){if(!(t instanceof e))throw new TypeError("Cannot call a class as a function")}(this,s);var t=function(t,e){if(!t)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!e||"object"!=typeof e&&"function"!=typeof e?t:e}(this,(s.__proto__||Object.getPrototypeOf(s)).call(this));return t.inputs=[],t.spans=[],t.inputsContainer="",t.newActive="",t}return function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Super expression must either be null or a function, not "+typeof e);t.prototype=Object.create(e&&e.prototype,{constructor:{value:t,enumerable:!1,writable:!0,configurable:!0}}),e&&(Object.setPrototypeOf?Object.setPrototypeOf(t,e):t.__proto__=e)}(s,HTMLElement),n(s,[{key:"type",get:function(){return this.getAttribute("type")},set:function(t){return this.setAttribute("type",t)}},{key:"offText",get:function(){return this.getAttribute("off-text")||"Off"}},{key:"onText",get:function(){return this.getAttribute("on-text")||"On"}}],[{key:"observedAttributes",get:function(){return["type","off-text","on-text"]}}]),n(s,[{key:"connectedCallback",value:function(){var t=this;if(this.inputs=[].slice.call(this.querySelectorAll("input")),2!==this.inputs.length||"radio"!==this.inputs[0].type)throw new Error('`Joomla-switcher` requires two inputs type="checkbox"');this.createMarkup.bind(this)(),this.inputsContainer=this.firstElementChild,this.inputsContainer.setAttribute("role","switch"),this.inputs[1].checked?(this.inputs[1].parentNode.classList.add("active"),this.spans[1].classList.add("active"),this.inputsContainer.setAttribute("aria-label",this.spans[1].innerHTML)):(this.spans[0].classList.add("active"),this.inputsContainer.setAttribute("aria-label",this.spans[0].innerHTML)),this.inputs.forEach(function(e){e.addEventListener("click",t.toggle.bind(t))}),this.inputsContainer.addEventListener("keydown",this.keyEvents.bind(this))}},{key:"disconnectedCallback",value:function(){this.removeEventListener("joomla.switcher.toggle",this.toggle,!0),this.removeEventListener("click",this.switch,!0),this.removeEventListener("keydown",this.keydown,!0)}},{key:"dispatchCustomEvent",value:function(t){var e=new CustomEvent(t,{bubbles:!0,cancelable:!0});e.relatedTarget=this,this.dispatchEvent(e),this.removeEventListener(t,this)}},{key:"createMarkup",value:function(){var t=0,e=document.createElement("span");e.classList.add("switcher"),e.setAttribute("tabindex",0),this.type||this.setAttribute("type","success");var i=document.createElement("span");i.classList.add("switch"),this.inputs.forEach(function(i,n){i.setAttribute("tabindex","-1"),i.checked&&e.setAttribute("aria-checked",!0),e.appendChild(i),1===n&&i.checked&&(t=1)}),e.appendChild(i);var n=document.createElement("span");n.classList.add("switcher-labels");var s=document.createElement("span");s.classList.add("switcher-label-0"),s.innerText=this.offText;var r=document.createElement("span");r.classList.add("switcher-label-1"),r.innerText=this.onText,0===t?s.classList.add("active"):r.classList.add("active"),this.spans.push(s),this.spans.push(r),n.appendChild(s),n.appendChild(r),this.appendChild(e),this.appendChild(n)}},{key:"switch",value:function(){this.spans.forEach(function(t){t.classList.remove("active")}),this.inputsContainer.classList.contains("active")?this.inputsContainer.classList.remove("active"):this.inputsContainer.classList.add("active"),this.inputs.forEach(function(t){t.classList.remove("active")}),1===this.newActive?(this.inputs[this.newActive].classList.add("active"),this.inputs[1].setAttribute("checked",""),this.inputs[0].removeAttribute("checked"),this.inputsContainer.setAttribute("aria-checked",!0),this.inputsContainer.setAttribute("aria-label",this.spans[1].innerHTML),this.dispatchCustomEvent("joomla.switcher.on")):(this.inputs[1].removeAttribute("checked"),this.inputs[0].setAttribute("checked",""),this.inputs[0].classList.add("active"),this.inputsContainer.setAttribute("aria-checked",!1),this.inputsContainer.setAttribute("aria-label",this.spans[0].innerHTML),this.dispatchCustomEvent("joomla.switcher.off")),this.spans[this.newActive].classList.add("active")}},{key:"toggle",value:function(){this.newActive=this.inputs[1].classList.contains("active")?0:1,this.switch.bind(this)()}},{key:"keyEvents",value:function(t){t.keyCode!==e&&t.keyCode!==i||(t.preventDefault(),this.newActive=this.inputs[1].classList.contains("active")?0:1,this.switch.bind(this)())}}]),s}();t.define("joomla-field-switcher",s)}(customElements)},{}]},{},[1]);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in joomla-field-user-es5.min.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-user-es5.min.js:1
Security Score:
71 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- !function(){return function t(e,i,n){function r(u,s){if(!i[u]){if(!e[u]){var a="function"==typeof require&&require;if(!s&&a)return a(u,!0);if(o)return o(u,!0);var l=new Error("Cannot find module '"+u+"'");throw l.code="MODULE_NOT_FOUND",l}var c=i[u]={exports:{}};e[u][0].call(c.exports,function(t){return r(e[u][1][t]||t)},c,c.exports,t,e,i,n)}return i[u].exports}for(var o="function"==typeof require&&require,u=0;u<n.length;u++)r(n[u]);return r}}()({1:[function(t,e,i){"use strict";var n=function(){function t(t,e){for(var i=0;i<e.length;i++){var n=e[i];n.enumerable=n.enumerable||!1,n.configurable=!0,"value"in n&&(n.writable=!0),Object.defineProperty(t,n.key,n)}}return function(e,i,n){return i&&t(e.prototype,i),n&&t(e,n),e}}();!function(t){var e=function(t){function e(){return function(t,e){if(!(t instanceof e))throw new TypeError("Cannot call a class as a function")}(this,e),function(t,e){if(!t)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!e||"object"!=typeof e&&"function"!=typeof e?t:e}(this,(e.__proto__||Object.getPrototypeOf(e)).apply(this,arguments))}return function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Super expression must either be null or a function, not "+typeof e);t.prototype=Object.create(e&&e.prototype,{constructor:{value:t,enumerable:!1,writable:!0,configurable:!0}}),e&&(Object.setPrototypeOf?Object.setPrototypeOf(t,e):t.__proto__=e)}(e,HTMLElement),n(e,[{key:"connectedCallback",value:function(){if(this.modal=this.querySelector(this.modalClass),this.modalBody=this.querySelector(".modal-body"),this.input=this.querySelector(this.inputId),this.inputName=this.querySelector(this.inputNameClass),this.buttonSelect=this.querySelector(this.buttonSelectClass),this.modalClose=this.modalClose.bind(this),this.setValue=this.setValue.bind(this),this.buttonSelect){this.buttonSelect.addEventListener("click",this.modalOpen.bind(this)),this.modal.addEventListener("hide",this.removeIframe.bind(this));var t=this.input.getAttribute("data-onchange"),e=void 0;t&&(e=new Function(t),this.input.addEventListener("change",e.bind(this.input)))}}},{key:"disconnectedCallback",value:function(){this.buttonSelect.removeEventListener("click",this),this.modal.removeEventListener("hide",this)}},{key:"modalOpen",value:function(){var t=this;this.removeIframe();var e=document.createElement("iframe");e.setAttribute("name","field-user-modal"),e.src=this.url.replace("{field-user-id}",this.input.getAttribute("id")),e.setAttribute("width",this.modalWidth),e.setAttribute("height",this.modalHeight),this.modalBody.appendChild(e),this.modal.open();var i=this.modalBody.querySelector("iframe");i.addEventListener("load",function(){var e=i.contentWindow.document;[].slice.call(e.querySelectorAll(".button-select")).forEach(function(e){e.addEventListener("click",function(e){t.setValue(e.target.getAttribute("data-user-value"),e.target.getAttribute("data-user-name")),t.modalClose()})})})}},{key:"modalClose",value:function(){Joomla.Modal.getCurrent().close(),this.modalBody.innerHTML=""}},{key:"removeIframe",value:function(){this.modalBody.innerHTML=""}},{key:"setValue",value:function(t,e){this.input.setAttribute("value",t),this.inputName.setAttribute("value",e||t)}},{key:"url",get:function(){return this.getAttribute("url")},set:function(t){this.setAttribute("url",t)}},{key:"modalClass",get:function(){return this.getAttribute("modal")},set:function(t){this.setAttribute("modal",t)}},{key:"modalWidth",get:function(){return this.getAttribute("modal-width")},set:function(t){this.setAttribute("modal-width",t)}},{key:"modalHeight",get:function(){return this.getAttribute("modal-height")},set:function(t){this.setAttribute("modal-height",t)}},{key:"inputId",get:function(){return this.getAttribute("input")},set:function(t){this.setAttribute("input",t)}},{key:"inputNameClass",get:function(){return this.getAttribute("input-name")},set:function(t){this.setAttribute("input-name",t)}},{key:"buttonSelectClass",get:function(){return this.getAttribute("button-select")},set:function(t){this.setAttribute("button-select",t)}}],[{key:"observedAttributes",get:function(){return["url","modal-class","modal-width","modal-height","input","input-name","button-select"]}}]),e}();t.define("joomla-field-user",e)}(customElements)},{}]},{},[1]);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L23

Insecure DOM Manipulation (XSS) in incompatible.js

CWE-79
File Location: build/incompatible_page/incompatible.js:23
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- header.innerHTML = errorLocale[ref].header;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L151

Insecure DOM Manipulation (XSS) in field-subform.js

CWE-79
File Location: build/media/webcomponents/js/field-subform/field-subform.js:151
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- this.template = tmplElement[0].innerHTML;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L123

Insecure DOM Manipulation (XSS) in indexer.js

CWE-79
File Location: media/com_finder/js/indexer.js:123
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- progressMessage.innerHTML = message;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in indexer.min.js

CWE-79
File Location: media/com_finder/js/indexer.min.js:1
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- Joomla=window.Joomla||{},function(e,r){"use strict";e.finderIndexer=function(){var n=null,t=null,s=null,o=!1,a="&"+r.getElementById("finder-indexer-token").getAttribute("name")+"=1",i=function(r){e.request({url:"index.php?option=com_finder&tmpl=component&format=json&task="+r+a,method:"GET",data:"",perform:!0,headers:{"Content-Type":"application/x-www-form-urlencoded"},onSuccess:function(e,r){l(JSON.parse(e))},onError:function(e){u(e)}})},d=function(e){var n=r.getElementById(e);if(n)return n.parentNode.removeChild(n)},l=function(s,a){var l=r.getElementById("finder-progress-header"),u=r.getElementById("finder-progress-message");try{if(null===s)throw a;if(s.error)throw s;s.start&&(n=s.totalItems),t+=s.batchOffset,c(s.header,s.message),t<n?i("indexer.batch"):o||(o=!0,i("indexer.optimize"))}catch(r){d("progress");try{s.error&&(l&&(l.innerText=s.header,l.classList.add("finder-error")),u&&(u.innerHTML=s.message,u.classList.add("finder-error")))}catch(n){""===r&&(r=e.JText._("COM_FINDER_NO_ERROR_RETURNED")),l&&(l.innerText=e.JText._("COM_FINDER_AN_ERROR_HAS_OCCURRED"),l.classList.add("finder-error")),u&&(u.innerHTML=r,u.classList.add("finder-error"))}}return!0},u=function(n){var t=r.getElementById("finder-progress-header"),s=r.getElementById("finder-progress-message");json="object"==typeof n&&n.responseText?n.responseText:null,json=json?JSON.parse(json):null,d("progress"),json&&(json=null!=json.responseText?Json.evaluate(json.responseText,!0):json);var o=json?json.header:e.JText._("COM_FINDER_AN_ERROR_HAS_OCCURRED"),a=json?json.message:e.JText._("COM_FINDER_MESSAGE_RETURNED")+"<br>"+json;t&&(t.innerText=o,t.classList.add("finder-error")),s&&(s.innerHTML=a,s.classList.add("finder-error"))},c=function(o,a){s=t/n*100;var i=r.getElementById("progress-bar"),l=r.getElementById("finder-progress-header"),u=r.getElementById("finder-progress-message");l&&(l.innerText=o),u&&(u.innerHTML=a),i&&(s<100?(i.style.width=s+"%",i.setAttribute("aria-valuenow",s)):(i.classList.remove("bar-success"),i.classList.add("bar-warning"),i.setAttribute("aria-valuemin",100),i.setAttribute("aria-valuemax",200),i.style.width=s+"%",i.setAttribute("aria-valuenow",s)),a===msg&&(d("progress"),e.Modal.getCurrent().close()))};t=0,s=0,i("indexer.start")}}(Joomla,document),document.addEventListener("DOMContentLoaded",function(){Indexer=Joomla.finderIndexer()});
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L83

Insecure DOM Manipulation (XSS) in admin-module-edit.js

CWE-79
File Location: media/com_modules/js/admin-module-edit.js:83
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- tmpStatus.innerHTML = '<span class=\"badge badge-success\">' + Joomla.JText._('JYES') + '</span>';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L32

Insecure DOM Manipulation (XSS) in helpsite.js

CWE-79
File Location: media/legacy/js/helpsite.js:32
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- document.getElementById(select_id).innerHTML = '';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L334

Insecure DOM Manipulation (XSS) in client.es6.js

CWE-79
File Location: media/plg_installer_webinstaller/js/client.es6.js:334
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- nameElement.innerHTML = name;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in stats-message.min.js

CWE-79
File Location: media/plg_system_stats/js/stats-message.min.js:1
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- Joomla=window.Joomla||{},function(t,e){"use strict";var n=function n(){var s=(arguments.length>0&&void 0!==arguments[0]?arguments[0]:{}).plugin,a="index.php?option=com_ajax&group=system&plugin="+(void 0===s?"sendStats":s)+"&format=raw",o=e.getElementById("system-message-container");t.request({url:a,headers:{"Content-Type":"application/json"},onSuccess:function(t){try{var s=JSON.parse(t);s&&s.html&&(o.innerHTML=s.html,o.querySelector(".js-pstats-alert").style.display="block",function(t){var n=e.getElementById("system-message-container"),s=n.querySelector(".js-pstats-alert"),a=n.querySelector(".js-pstats-data-details");e.addEventListener("click",function(t){t.target.classList.contains("js-pstats-btn-details")&&(t.preventDefault(),a.classList.toggle("d-none"))}),e.addEventListener("click",function(e){e.target.classList.contains("js-pstats-btn-allow-always")&&(e.preventDefault(),s.close(),t({plugin:"sendAlways"}))}),e.addEventListener("click",function(e){e.target.classList.contains("js-pstats-btn-allow-once")&&(e.preventDefault(),s.close(),t({plugin:"sendOnce"}))}),e.addEventListener("click",function(e){e.target.classList.contains("js-pstats-btn-allow-never")&&(e.preventDefault(),s.close(),t({plugin:"sendNever"}))})}(n))}catch(t){throw new Error(t)}},onError:function(e){t.renderMessages({error:[e.response]})}})};e.addEventListener("DOMContentLoaded",function(){n()})}(Joomla,document);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in cms.min.js

CWE-79
File Location: media/system/js/cms.min.js:1
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- Joomla=window.Joomla||{},function(e,a){"use strict";a.setcollapse=function(a,n,o){e.getElementById("collapse-"+n)||(e.getElementById("container-collapse").innerHTML='<div class="collapse fade" id="collapse-'+n+'"><iframe class="iframe" src="'+a+'" height="'+o+'" width="100%"></iframe></div>')},window.jQuery&&function(a){function n(e,n){for(var o,t,i,d,l=!0,r=e.data("showon")||[],s=0,f=r.length;s<f;s++)i=(t=r[s]||{}).field,d=a('[name="'+i+'"], [name="'+i+'[]"]'),t.valid=0,d.each(function(){var e=a(this);if(-1!==["checkbox","radio"].indexOf(e.attr("type"))){if(!e.prop("checked"))return;o=e.val()}else null==(o=e.val())&&"select"==e.prop("tagName").toLowerCase()&&(o=[]);for(var n in"object"!=typeof o&&(o=JSON.parse('["'+o+'"]')),o)o.propertyIsEnumerable(n)&&("="==r[s].sign&&-1!==r[s].values.indexOf(o[n])&&(r[s].valid=1),"!="==r[s].sign&&-1===r[s].values.indexOf(o[n])&&(r[s].valid=1))}),""===t.op?0===t.valid&&(l=!1):("AND"===t.op&&t.valid+r[s-1].valid<2&&(l=!1),"OR"===t.op&&t.valid+r[s-1].valid>0&&(l=!0));n?l?e.slideDown():e.slideUp():e.toggle(l)}function o(o){for(var t=a(o=o||e).find("[data-showon]"),i=0,d=t.length;i<d;i++)!function(){for(var e,o=a(t[i]),d=o.data("showon")||[],l=a(),r=0,s=d.length;r<s;r++)e=d[r].field,l=l.add(a('[name="'+e+'"], [name="'+e+'[]"]'));n(o),l.on("change",function(){n(o,!0)})}()}e.addEventListener("DOMContentLoaded",function(e){o(e.target)}),e.addEventListener("joomla:updated",function(e){var n=a(e.target);if(n.hasClass("subform-repeatable-group"))for(var t,i,d=n.find("[data-showon]"),l=n.data("baseName"),r=n.data("group"),s=new RegExp("\\["+l+"\\]\\["+l+"X\\]","g"),f="["+l+"]["+r+"]",c=0,p=d.length;c<p;c++)i=(t=a(d[c])).attr("data-showon").replace(s,f),t.attr("data-showon",i);o(e.target)})}(jQuery)}(document,Joomla);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L668

Insecure DOM Manipulation (XSS) in calendar.js

CWE-79
File Location: media/system/js/fields/calendar.js:668
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- cell.innerHTML = JoomlaCalLocale.shortDays[(i + fdow) % 7];
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L105

Insecure DOM Manipulation (XSS) in passwordstrength.js

CWE-79
File Location: media/system/js/fields/passwordstrength.js:105
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- label.innerHTML = Joomla.JText._('JFIELD_PASSWORD_INDICATE_INCOMPLETE');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L182

Insecure DOM Manipulation (XSS) in joomla-field-media-es5.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-media-es5.js:182
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- div.innerHTML = '<span class="field-media-preview-icon fa fa-picture-o"></span>';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in joomla-field-media.min.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-media.min.js:1
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- ((t,e)=>{if(!e)throw new Error("Joomla API is not properly initiated");e.selectedFile={},window.document.addEventListener("onMediaFileSelected",t=>{e.selectedFile=t.detail}),e.doIt=((t,i,s)=>{if(!0===t.success){if(t.data[0].url)if(/local-/.test(t.data[0].adapter)){const i=e.getOptions("system.paths").rootFull;e.selectedFile.url=t.data[0].url.split(i)[1],t.data[0].thumb_path?e.selectedFile.thumb=t.data[0].thumb_path:e.selectedFile.thumb=!1}else t.data[0].thumb_path&&(e.selectedFile.thumb=t.data[0].thumb_path);else e.selectedFile.url=!1;const r=t=>"object"==typeof HTMLElement?t instanceof HTMLElement:t&&"object"==typeof t&&null!==t&&1===t.nodeType&&"string"==typeof t.nodeName;e.selectedFile.url&&(r(i)||"object"==typeof i?!r(i)&&"object"==typeof i&&i.id?window.parent.Joomla.editors.instances[i.id].replaceSelection(`<img src="${e.selectedFile.url}" alt=""/>`):(i.value=e.selectedFile.url,s.updatePreview()):e.editors.instances[i].replaceSelection(`<img src="${e.selectedFile.url}" alt=""/>`))}}),e.getImage=((t,i,s)=>new Promise((r,l)=>{const o=`${e.getOptions("system.paths").rootFull}administrator/index.php?option=com_media&format=json`;e.request({url:`${o}&task=api.files&url=true&path=${t.path}&${e.getOptions("csrf.token")}=1&format=json`,method:"GET",perform:!0,headers:{"Content-Type":"application/json"},onSuccess:t=>{const l=JSON.parse(t);r(e.doIt(l,i,s))},onError:()=>{l()}})}));t.define("joomla-field-media",class extends HTMLElement{static get observedAttributes(){return["type","base-path","root-folder","url","modal-container","modal-width","modal-height","input","button-select","button-clear","button-save-selected","preview","preview-width","preview-height"]}get type(){return this.getAttribute("type")}set type(t){this.setAttribute("type",t)}get basePath(){return this.getAttribute("base-path")}set basePath(t){this.setAttribute("base-path",t)}get rootFolder(){return this.getAttribute("root-folder")}set rootFolder(t){this.setAttribute("root-folder",t)}get url(){return this.getAttribute("url")}set url(t){this.setAttribute("url",t)}get modalContainer(){return this.getAttribute("modal-container")}set modalContainer(t){this.setAttribute("modal-container",t)}get input(){return this.getAttribute("input")}set input(t){this.setAttribute("input",t)}get buttonSelect(){return this.getAttribute("button-select")}set buttonSelect(t){this.setAttribute("button-select",t)}get buttonClear(){return this.getAttribute("button-clear")}set buttonClear(t){this.setAttribute("button-clear",t)}get buttonSaveSelected(){return this.getAttribute("button-save-selected")}set buttonSaveSelected(t){this.setAttribute("button-save-selected",t)}get modalWidth(){return this.getAttribute(parseInt("modal-width",10))}set modalWidth(t){this.setAttribute("modal-width",t)}get modalHeight(){return this.getAttribute(parseInt("modal-height",10))}set modalHeight(t){this.setAttribute("modal-height",t)}get previewWidth(){return this.getAttribute(parseInt("preview-width",10))}set previewWidth(t){this.setAttribute("preview-width",t)}get previewHeight(){return this.getAttribute(parseInt("preview-height",10))}set previewHeight(t){this.setAttribute("preview-height",t)}get preview(){return this.getAttribute("preview")}set preview(t){this.setAttribute("preview",t)}get previewContainer(){return this.getAttribute("preview-container")}connectedCallback(){const t=this.querySelector(this.buttonSelect),e=this.querySelector(this.buttonClear);this.show=this.show.bind(this),this.modalClose=this.modalClose.bind(this),this.clearValue=this.clearValue.bind(this),this.setValue=this.setValue.bind(this),this.updatePreview=this.updatePreview.bind(this),t.addEventListener("click",this.show),e&&e.addEventListener("click",this.clearValue),this.updatePreview()}disconnectedCallback(){this.querySelector(this.buttonClear).removeEventListener("click",this)}show(){const t=this;this.querySelector('[role="dialog"]').open(),this.querySelector(this.buttonSaveSelected).addEventListener("click",e=>(e.preventDefault(),e.stopPropagation(),this.selectedPath&&t.setValue(this.selectedPath),t.modalClose(),!1))}modalClose(){const t=this.querySelector(this.input);e.getImage(e.selectedFile,t,this),e.Modal.getCurrent().close()}setValue(t){this.querySelector(this.input).value=t,this.updatePreview()}clearValue(){this.setValue("")}updatePreview(){if(-1!==["true","static"].indexOf(this.preview)&&"false"!==this.preview&&this.preview){const t=this.querySelector(this.input).value,i=this.querySelector(".field-media-preview");if(t){i.innerHTML="";const s=new Image;switch(this.type){case"image":s.src=s.src=/http/.test(t)?t:e.getOptions("system.paths").rootFull+t}i.style.width=this.previewWidth,i.appendChild(s)}else i.innerHTML='<span class="field-media-preview-icon fa fa-picture-o"></span>'}}})})(customElements,Joomla);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in joomla-field-simple-color-es5.min.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-simple-color-es5.min.js:1
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- !function(){return function e(t,n,i){function r(a,s){if(!n[a]){if(!t[a]){var l="function"==typeof require&&require;if(!s&&l)return l(a,!0);if(o)return o(a,!0);var f=new Error("Cannot find module '"+a+"'");throw f.code="MODULE_NOT_FOUND",f}var c=n[a]={exports:{}};t[a][0].call(c.exports,function(e){return r(t[a][1][e]||e)},c,c.exports,e,t,n,i)}return n[a].exports}for(var o="function"==typeof require&&require,a=0;a<i.length;a++)r(i[a]);return r}}()({1:[function(e,t,n){"use strict";var i=function(){function e(e,t){for(var n=0;n<t.length;n++){var i=t[n];i.enumerable=i.enumerable||!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(e,i.key,i)}}return function(t,n,i){return n&&e(t.prototype,n),i&&e(t,i),t}}();!function(e){var t=9,n=27,r={aliceblue:"#f0f8ff",antiquewhite:"#faebd7",aqua:"#00ffff",aquamarine:"#7fffd4",azure:"#f0ffff",beige:"#f5f5dc",bisque:"#ffe4c4",black:"#000000",blanchedalmond:"#ffebcd",blue:"#0000ff",blueviolet:"#8a2be2",brown:"#a52a2a",burlywood:"#deb887",cadetblue:"#5f9ea0",chartreuse:"#7fff00",chocolate:"#d2691e",coral:"#ff7f50",cornflowerblue:"#6495ed",cornsilk:"#fff8dc",crimson:"#dc143c",cyan:"#00ffff",darkblue:"#00008b",darkcyan:"#008b8b",darkgoldenrod:"#b8860b",darkgray:"#a9a9a9",darkgreen:"#006400",darkgrey:"#a9a9a9",darkkhaki:"#bdb76b",darkmagenta:"#8b008b",darkolivegreen:"#556b2f",darkorange:"#ff8c00",darkorchid:"#9932cc",darkred:"#8b0000",darksalmon:"#e9967a",darkseagreen:"#8fbc8f",darkslateblue:"#483d8b",darkslategray:"#2f4f4f",darkslategrey:"#2f4f4f",darkturquoise:"#00ced1",darkviolet:"#9400d3",deeppink:"#ff1493",deepskyblue:"#00bfff",dimgray:"#696969",dimgrey:"#696969",dodgerblue:"#1e90ff",firebrick:"#b22222",floralwhite:"#fffaf0",forestgreen:"#228b22",fuchsia:"#ff00ff",gainsboro:"#dcdcdc",ghostwhite:"#f8f8ff",gold:"#ffd700",goldenrod:"#daa520",gray:"#808080",green:"#008000",greenyellow:"#adff2f",grey:"#808080",honeydew:"#f0fff0",hotpink:"#ff69b4",indianred:"#cd5c5c",indigo:"#4b0082",ivory:"#fffff0",khaki:"#f0e68c",lavender:"#e6e6fa",lavenderblush:"#fff0f5",lawngreen:"#7cfc00",lemonchiffon:"#fffacd",lightblue:"#add8e6",lightcoral:"#f08080",lightcyan:"#e0ffff",lightgoldenrodyellow:"#fafad2",lightgray:"#d3d3d3",lightgreen:"#90ee90",lightgrey:"#d3d3d3",lightpink:"#ffb6c1",lightsalmon:"#ffa07a",lightseagreen:"#20b2aa",lightskyblue:"#87cefa",lightslategray:"#778899",lightslategrey:"#778899",lightsteelblue:"#b0c4de",lightyellow:"#ffffe0",lime:"#00ff00",limegreen:"#32cd32",linen:"#faf0e6",magenta:"#ff00ff",maroon:"#800000",mediumaquamarine:"#66cdaa",mediumblue:"#0000cd",mediumorchid:"#ba55d3",mediumpurple:"#9370db",mediumseagreen:"#3cb371",mediumslateblue:"#7b68ee",mediumspringgreen:"#00fa9a",mediumturquoise:"#48d1cc",mediumvioletred:"#c71585",midnightblue:"#191970",mintcream:"#f5fffa",mistyrose:"#ffe4e1",moccasin:"#ffe4b5",navajowhite:"#ffdead",navy:"#000080",oldlace:"#fdf5e6",olive:"#808000",olivedrab:"#6b8e23",orange:"#ffa500",orangered:"#ff4500",orchid:"#da70d6",palegoldenrod:"#eee8aa",palegreen:"#98fb98",paleturquoise:"#afeeee",palevioletred:"#db7093",papayawhip:"#ffefd5",peachpuff:"#ffdab9",peru:"#cd853f",pink:"#ffc0cb",plum:"#dda0dd",powderblue:"#b0e0e6",purple:"#800080",red:"#ff0000",rosybrown:"#bc8f8f",royalblue:"#4169e1",saddlebrown:"#8b4513",salmon:"#fa8072",sandybrown:"#f4a460",seagreen:"#2e8b57",seashell:"#fff5ee",sienna:"#a0522d",silver:"#c0c0c0",skyblue:"#87ceeb",slateblue:"#6a5acd",slategray:"#708090",slategrey:"#708090",snow:"#fffafa",springgreen:"#00ff7f",steelblue:"#4682b4",tan:"#d2b48c",teal:"#008080",thistle:"#d8bfd8",tomato:"#ff6347",turquoise:"#40e0d0",violet:"#ee82ee",wheat:"#f5deb3",white:"#ffffff",whitesmoke:"#f5f5f5",yellow:"#ffff00",yellowgreen:"#9acd32"},o=function(e){function o(){!function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}(this,o);var e=function(e,t){if(!e)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!t||"object"!=typeof t&&"function"!=typeof t?e:t}(this,(o.__proto__||Object.getPrototypeOf(o)).call(this));return e.select="",e.options=[],e.icon="",e.panel="",e.buttons=[],e.focusableElements=null,e.focusableSelectors=["a[href]","area[href]","input:not([disabled])","select:not([disabled])","textarea:not([disabled])","button:not([disabled])","iframe","object","embed","[contenteditable]",'[tabindex]:not([tabindex^="-"])'],e}return function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Super expression must either be null or a function, not "+typeof t);e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,enumerable:!1,writable:!0,configurable:!0}}),t&&(Object.setPrototypeOf?Object.setPrototypeOf(e,t):e.__proto__=t)}(o,HTMLElement),i(o,[{key:"connectedCallback",value:function(){var e=this;if(this.select=this.querySelector("select"),!this.select)throw new Error("Simple color field requires a select element");this.options=[].slice.call(this.select.querySelectorAll("option")),this.select.classList.add("hidden"),this.options.forEach(function(t){var n=t.value,i="swatch";"none"===n&&(i+=" nocolor",n="transparent"),t.selected&&(i+=" active");var r=document.createElement("button");r.setAttribute("class",i),r.style.backgroundColor=n,r.setAttribute("type","button");var o="transparent"===n?e.textTransp:e.getColorName(n);r.innerHTML='<span class="sr-only">'+o+"</span>",e.buttons.push(r)});var t=document.createElement("button");t.setAttribute("class","btn-close"),t.setAttribute("type","button"),t.innerHTML=this.textClose,this.buttons.push(t);var n=this.select.value,i="";"none"===n&&(i+=" nocolor",n="transparent"),this.icon=document.createElement("button"),i&&this.icon.setAttribute("class",i);var r="simple-color-"+Math.random().toString(36).substr(2,10);this.icon.setAttribute("type","button"),this.icon.setAttribute("tabindex","0"),this.icon.style.backgroundColor=n,this.icon.innerHTML='<span class="sr-only">'+this.textSelect+"</span>",this.icon.id=r,this.select.insertAdjacentElement("beforebegin",this.icon),this.icon.addEventListener("click",this.show.bind(this)),this.panel=document.createElement("div"),this.panel.classList.add("simplecolors-panel"),this.panel.setAttribute("aria-labelledby",r),this.hide=this.hide.bind(this),this.colorSelect=this.colorSelect.bind(this),this.buttons.forEach(function(t){t.classList.contains("btn-close")?t.addEventListener("click",e.hide):t.addEventListener("click",e.colorSelect),e.panel.insertAdjacentElement("beforeend",t)}),this.appendChild(this.panel),this.focusableElements=[].slice.call(this.panel.querySelectorAll(this.focusableSelectors.join())),this.keys=this.keys.bind(this),this.hide=this.hide.bind(this),this.mousedown=this.mousedown.bind(this)}},{key:"disconnectedCallback",value:function(){}},{key:"show",value:function(){document.addEventListener("mousedown",this.hide),this.addEventListener("keydown",this.keys),this.panel.addEventListener("mousedown",this.mousedown),this.panel.setAttribute("data-open","");var e=this.panel.querySelector("button");e&&e.focus()}},{key:"hide",value:function(){document.removeEventListener("mousedown",this.hide,!1),this.removeEventListener("keydown",this.keys),this.panel.hasAttribute("data-open")&&this.panel.removeAttribute("data-open"),this.icon.focus()}},{key:"colorSelect",value:function(e){var t="",n="",i="";e.target.classList.contains("nocolor")?(t="none",n="transparent",i="nocolor"):(t=this.rgb2hex(e.target.style.backgroundColor),n=t),this.buttons.forEach(function(e){e.classList.contains("active")&&e.classList.remove("active")}),e.target.classList.add("active"),this.icon.classList.remove("nocolor"),this.icon.setAttribute("class",i),this.icon.style.backgroundColor=n,this.hide(),this.options.forEach(function(e){e.selected&&e.removeAttribute("selected"),e.value===n&&e.setAttribute("selected","")})}},{key:"keys",value:function(e){if(e.keyCode===n&&this.hide(),e.keyCode===t){var i=this.focusableElements.indexOf(document.activeElement);!e.shiftKey||0!==i&&-1!==i||(this.focusableElements[this.focusableElements.length-1].focus(),e.preventDefault()),e.shiftKey||i!==this.focusableElements.length-1||(this.focusableElements[0].focus(),e.preventDefault())}}},{key:"mousedown",value:function(e){e.stopPropagation(),e.preventDefault()}},{key:"getColorName",value:function(e){var t=e;if(4===e.length){var n=e.split("");t=n[0]+n[1]+n[1]+n[2]+n[2]+n[3]+n[3]}for(var i in r)if(r.hasOwnProperty(i)&&t.toLowerCase()===r[i])return i;return this.textColor+" "+e.replace("#","").split("").join(", ")}},{key:"rgb2hex",value:function(e){var t=function(e){return("0"+parseInt(e,10).toString(16)).slice(-2)},n=e.match(/^rgb\((\d+),\s*(\d+),\s*(\d+)\)$/);return"#"+t(n[1])+t(n[2])+t(n[3])}},{key:"textSelect",get:function(){return this.getAttribute("text-select")}},{key:"textColor",get:function(){return this.getAttribute("text-color")}},{key:"textClose",get:function(){return this.getAttribute("text-close")}},{key:"textTransp",get:function(){return this.getAttribute("text-transparent")}}],[{key:"observedAttributes",get:function(){return["text-select","text-color","text-close","text-transparent"]}}]),o}();e.define("joomla-field-simple-color",o)}(customElements)},{}]},{},[1]);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in joomla-field-subform.min.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-subform.min.js:1
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- !function(t){"use strict";const e={SPACE:32,ESC:27,ENTER:13};let r="matches";["matches","msMatchesSelector"].some(function(t){return"function"==typeof document.body[t]&&(r=t,!0)});function a(t,e){let a;for(;t;){if((a=t.parentElement)&&a[r](e))return a;t=a}return null}t.define("joomla-field-subform",class extends HTMLElement{get buttonAdd(){return this.getAttribute("button-add")}get buttonRemove(){return this.getAttribute("button-remove")}get buttonMove(){return this.getAttribute("button-move")}get rowsContainer(){return this.getAttribute("rows-container")}get repeatableElement(){return this.getAttribute("repeatable-element")}get minimum(){return this.getAttribute("minimum")}get maximum(){return this.getAttribute("maximum")}get name(){return this.getAttribute("name")}set name(t){return this.template=this.template.replace(new RegExp(' name="'+this.name.replace(/[\[\]]/g,"\\$&"),"g"),' name="'+t),this.setAttribute("name",t)}constructor(){super();let t=this;if(this.containerWithRows=this,this.rowsContainer){let t=this.querySelectorAll(this.rowsContainer);for(let e=0,r=t.length;e<r;e++)if(a(t[e],"joomla-field-subform")===this){this.containerWithRows=t[e];break}}this.lastRowNum=this.getRows().length,this.template="",this.prepareTemplate(),(this.buttonAdd||this.buttonRemove)&&(this.addEventListener("click",function(e){let i=null,n=null;if(t.buttonAdd&&(i=e.target[r](t.buttonAdd)?e.target:a(e.target,t.buttonAdd)),t.buttonRemove&&(n=e.target[r](t.buttonRemove)?e.target:a(e.target,t.buttonRemove)),i&&a(i,"joomla-field-subform")===t){let r=a(i,t.repeatableElement);r=a(r,"joomla-field-subform")===t?r:null,t.addRow(r),e.preventDefault()}else if(n&&a(n,"joomla-field-subform")===t){let r=a(n,t.repeatableElement);t.removeRow(r),e.preventDefault()}}),this.addEventListener("keydown",function(i){if(i.keyCode!==e.SPACE)return;let n=t.buttonAdd&&i.target[r](t.buttonAdd),l=t.buttonRemove&&i.target[r](t.buttonRemove);if((n||l)&&a(i.target,"joomla-field-subform")===t){let e=a(i.target,t.repeatableElement);e=a(e,"joomla-field-subform")===t?e:null,l&&e?t.removeRow(e):n&&t.addRow(e),i.preventDefault()}})),this.buttonMove&&this.setUpDragSort()}getRows(){let t=this.containerWithRows.children,e=document.body.msMatchesSelector?"msMatchesSelector":"matches",r=[];for(let a=0,i=t.length;a<i;a++)t[a][e](this.repeatableElement)&&r.push(t[a]);return r}prepareTemplate(){let t=[].slice.call(this.children).filter(function(t){return t.classList.contains("subform-repeatable-template-section")});if(t[0]&&(this.template=t[0].innerHTML),!this.template)throw new Error("The row template are required to subform element to work")}addRow(t){const e=this.getRows().length;if(e>=this.maximum)return null;let r;(r="TBODY"===this.containerWithRows.nodeName||"TABLE"===this.containerWithRows.nodeName?document.createElement("tbody"):document.createElement("div")).innerHTML=this.template;let a=r.children[0];return t?t.parentNode.insertBefore(a,t.nextSibling):this.containerWithRows.append(a),this.buttonMove&&(a.setAttribute("draggable","false"),a.setAttribute("aria-grabbed","false"),a.setAttribute("tabindex","0")),a.setAttribute("data-new","1"),this.fixUniqueAttributes(a,e),this.dispatchEvent(new CustomEvent("subform-row-add",{detail:{row:a},bubbles:!0})),window.Joomla&&Joomla.Event.dispatch(a,"joomla:updated"),a}removeRow(t){this.getRows().length<=this.minimum||(this.dispatchEvent(new CustomEvent("subform-row-remove",{detail:{row:t},bubbles:!0})),window.Joomla&&Joomla.Event.dispatch(t,"joomla:removed"),t.parentNode.removeChild(t))}fixUniqueAttributes(t,e){this.lastRowNum++,e=e||0;let r=t.getAttribute("data-group"),i=t.getAttribute("data-base-name"),n=Math.max(this.lastRowNum,e+1),l=i+n;this.lastRowNum=n,t.setAttribute("data-group",l);let o=t.querySelectorAll("[name]"),s={};for(let e=0,i=(o=[].slice.call(o).filter(t=>a(t,"joomla-field-subform")===this)).length;e<i;e++){let i=o[e],n=i.getAttribute("name"),u=n.replace(/(\[\]$)/g,"").replace(/(\]\[)/g,"__").replace(/\[/g,"_").replace(/\]/g,""),b=n.replace("["+r+"][","["+l+"]["),d=u.replace(r,l),m=0,f=u;if("checkbox"===i.type&&n.match(/\[\]$/)){if(!(m=s[u]?s[u].length:0)){let e=a(i,"fieldset.checkboxes"),r=t.querySelector('label[for="'+u+'"]');e&&e.setAttribute("id",d),r&&(r.setAttribute("for",d),r.setAttribute("id",d+"-lbl"))}f+=m,d+=m}else if("radio"===i.type){if(!(m=s[u]?s[u].length:0)){let e=a(i,"fieldset.radio"),r=t.querySelector('label[for="'+u+'"]');e&&e.setAttribute("id",d),r&&(r.setAttribute("for",d),r.setAttribute("id",d+"-lbl"))}f+=m,d+=m}s[u]?s[u].push(!0):s[u]=[!0],i.name=b,i.id&&(i.id=d);let g=t.querySelector('label[for="'+f+'"]');g&&(g.setAttribute("for",d),g.setAttribute("id",d+"-lbl"))}}setUpDragSort(){let t=this,i=null,n=!1,l=this.getRows();for(let t=0,e=l.length;t<e;t++){let e=l[t];e.setAttribute("draggable","false"),e.setAttribute("aria-grabbed","false"),e.setAttribute("tabindex","0")}function o(e){return!e.form&&e[r](t.buttonMove)?e:a(e,t.buttonMove)}function s(t,e){let r=!1;if(t.parentNode===e.parentNode)for(let a=t;a;a=a.previousSibling)if(a===e){r=!0;break}r?e.parentNode.insertBefore(t,e):e.parentNode.insertBefore(t,e.nextSibling)}this.addEventListener("touchstart",function(e){n=!0;let r=o(e.target),l=r?a(r,t.repeatableElement):null;l&&a(l,"joomla-field-subform")===t&&(i?(l!==i&&s(i,l),i.setAttribute("draggable","false"),i.setAttribute("aria-grabbed","false"),i=null):(l.setAttribute("draggable","true"),l.setAttribute("aria-grabbed","true"),i=l),e.preventDefault())}),this.addEventListener("mousedown",function(e){if(n)return;let r=o(e.target),l=r?a(r,t.repeatableElement):null;l&&a(l,"joomla-field-subform")===t&&(l.setAttribute("draggable","true"),l.setAttribute("aria-grabbed","true"),i=l)}),this.addEventListener("mouseup",function(t){i&&!n&&(i.setAttribute("draggable","false"),i.setAttribute("aria-grabbed","false"),i=null)}),this.addEventListener("keydown",function(n){if(n.keyCode!==e.ESC&&n.keyCode!==e.SPACE&&n.keyCode!==e.ENTER||n.target.form||!n.target[r](t.repeatableElement))return;let l=n.target;if(l&&a(l,"joomla-field-subform")===t&&(n.keyCode===e.SPACE&&function(t){return t.ctrlKey||t.metaKey||t.shiftKey}(n)&&("true"===l.getAttribute("aria-grabbed")?(l.setAttribute("draggable","false"),l.setAttribute("aria-grabbed","false"),i=null):(i&&(i.setAttribute("draggable","false"),i.setAttribute("aria-grabbed","false"),i=null),l.setAttribute("draggable","true"),l.setAttribute("aria-grabbed","true"),i=l),n.preventDefault()),n.keyCode===e.ESC&&i&&(i.setAttribute("draggable","false"),i.setAttribute("aria-grabbed","false"),i=null),n.keyCode===e.ENTER&&i)){if(i.setAttribute("draggable","false"),i.setAttribute("aria-grabbed","false"),l===i)return void(i=null);s(i,l),n.preventDefault(),i=null}}),this.addEventListener("dragstart",function(t){i&&(t.dataTransfer.effectAllowed="move",t.dataTransfer.setData("text",""))}),this.addEventListener("dragover",function(t){i&&t.preventDefault()}),this.addEventListener("dragenter",function(e){if(!i||t.rowsContainer&&a(e.target,t.rowsContainer)!==t.containerWithRows)return;let n=e.target[r](t.repeatableElement)?e.target:a(e.target,t.repeatableElement);n&&s(i,n)}),this.addEventListener("dragend",function(){i&&(i.setAttribute("draggable","false"),i.setAttribute("aria-grabbed","false"),i=null)})}})}(customElements);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L239

Insecure DOM Manipulation (XSS) in joomla-tab.js

CWE-79
File Location: media/system/webcomponents/js/joomla-tab.js:239
Security Score:
70 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- aElement.innerHTML = tab.getAttribute('name');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L73

Insecure DOM Manipulation (XSS) in admin-module-edit.js

CWE-79
File Location: media/com_modules/js/admin-module-edit.js:73
Security Score:
69 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- tmpMenu.innerHTML = '<span class=\"badge badge-success\">' + Joomla.JText._('JYES') + '</span>';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L112

Insecure DOM Manipulation (XSS) in client.es6.js

CWE-79
File Location: media/plg_installer_webinstaller/js/client.es6.js:112
Security Score:
69 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- jedContainer.innerHTML = response.data.html;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in client.min.js

CWE-79
File Location: media/plg_installer_webinstaller/js/client.min.js:1
Security Score:
69 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- var _createClass=function(){function e(e,t){for(var i=0;i<t.length;i++){var n=t[i];n.enumerable=n.enumerable||!1,n.configurable=!0,"value"in n&&(n.writable=!0),Object.defineProperty(e,n.key,n)}}return function(t,i,n){return i&&e(t.prototype,i),n&&e(t,n),t}}();function _classCallCheck(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}if(!window.jQuery)throw new Error("WebInstaller plugin requires jQuery");if(!Joomla)throw new Error("Joomla API is not properly initialised");!function(e,t,i,n){"use strict";var l={view:"dashboard",id:0,ordering:"",list:0,options:i.getOptions("plg_installer_webinstaller",{})},a=void 0,r=function(){function a(){_classCallCheck(this,a)}return _createClass(a,[{key:"initialise",value:function(){if(l.loaded=1,t.getElementById("myTabContent")){var e=t.getElementById("web");t.getElementById("uploadform-web-cancel").addEventListener("click",function(){t.getElementById("uploadform-web").classList.add("hidden"),l.list&&t.querySelector(".list-view")&&t.querySelector(".list-view").click()}),e.insertAdjacentHTML("afterbegin",'<div id="appsloading" class="ifw-loading-container"></div>'),e.style.position="absolute",n("#appsloading").on("ajaxStart",function(){t.body.classList.add("ifw-busy"),t.getElementById("appsloading").classList.remove("hidden")}).on("ajaxStop",function(){t.getElementById("appsloading").classList.add("hidden"),t.body.classList.remove("ifw-busy")})}this.loadweb(l.options.base_url+"index.php?format=json&option=com_apps&view=dashboard"),this.clickforlinks()}},{key:"loadweb",value:function(r){if(!r)return!1;var o=this,s=new RegExp(l.options.base_url),d=new RegExp("^index.php");if(!s.test(r)&&!d.test(r))return e.open(r,"_blank"),!1;var c=r+"&product="+l.options.product+"&release="+l.options.release+"&dev_level="+l.options.dev_level+"&list="+(l.list?"list":"grid")+"&lang="+l.options.language;if(""!==l.ordering&&t.getElementById("com-apps-ordering").value&&(l.ordering=t.getElementById("com-apps-ordering").value,c+="&ordering="+l.ordering),t.getElementById("myTabContent")){var u=t.getElementById("appsloading");u.style.position="absolute",u.style.left="0",u.style.top="0",u.style.width="100%",u.style.height="100%";var p=t.getElementById("web");p.style.position="relative",p.appendChild(u),n("#appsloading").trigger("ajaxStart")}return n.ajax({url:c,dataType:"jsonp",cache:!0,jsonpCallback:"jedapps_jsonpcallback",timeout:2e4,success:function(e){t.getElementById("web-loader")&&t.getElementById("web-loader").classList.add("hidden"),t.getElementById("jed-container").innerHTML=e.data.html,t.getElementById("com-apps-searchbox").addEventListener("keypress",function(e){13===e.which&&o.initiateSearch()}),t.getElementById("search-extensions").addEventListener("click",function(){o.initiateSearch()}),t.getElementById("search-reset").addEventListener("click",function(){t.getElementById("com-apps-searchbox").value="",o.initiateSearch()});var i=t.getElementById("com-apps-ordering");i&&i.addEventListener("change",function(){var e=i.selectedIndex;l.ordering=i.options[e].value,o.installfromwebajaxsubmit()}),""!==l.options.installfrom_url&&o.installfromweb(l.options.installfrom_url)},fail:function(){t.getElementById("web-loader")&&(t.getElementById("web-loader").classList.add("hidden"),t.getElementById("web-loader-error").classList.remove("hidden"))},complete:function(){var r=t.getElementById("joomlaapsinstallatinput");if(r&&(r.value=l.options.installat_url),o.clickforlinks(),a.clicker(),"extension"!==l.view&&[].slice.call(t.querySelectorAll("div.load-extension")).forEach(function(e){e.addEventListener("click",function(t){t.preventDefault(),o.processLinkClick(e.getAttribute("data-url"))}),e.setAttribute("href","#")}),"extension"===l.view){var s=t.getElementById("install-extension"),d=t.getElementById("install-extension-from-external");s&&s.addEventListener("click",function(){o.installfromweb(s.getAttribute("data-downloadurl"),s.getAttribute("data-name"))}),d&&d.addEventListener("click",function(){var n=d.getAttribute("data-downloadurl");!0===e.confirm(i.JText._("PLG_INSTALLER_WEBINSTALLER_REDIRECT_TO_EXTERNAL_SITE_TO_INSTALL").replace("[SITEURL]",n))&&(t.getElementById("adminForm").setAttribute("action",n),t.querySelector("input[name=task]").setAttribute("disabled",!0),t.querySelector("input[name=install_directory]").setAttribute("disabled",!0),t.querySelector("input[name=install_url]").setAttribute("disabled",!0),t.querySelector("input[name=installtype]").setAttribute("disabled",!0),t.querySelector("input[name=filter_search]").setAttribute("disabled",!0),t.getElementById("adminForm").submit())})}l.list&&t.querySelector(".list-view")&&t.querySelector(".list-view").click(),t.getElementById("myTabContent")&&n("#appsloading").trigger("ajaxStop")},error:function(e){var i=t.getElementById("web-loader-error"),n=t.getElementById("web-loader");e.responseText&&i&&(i.innerHTML=e.responseText),n&&(n.classList.add("hidden"),i.classList.remove("hidden"))}}),!0}},{key:"clickforlinks",value:function(){var e=this;[].slice.call(t.querySelectorAll("a.transcode")).forEach(function(t){var i=t.getAttribute("href");t.addEventListener("click",function(t){t.preventDefault(),e.processLinkClick(i)}),t.setAttribute("href","#")})}},{key:"initiateSearch",value:function(){l.view="dashboard",this.installfromwebajaxsubmit()}},{key:"installfromwebajaxsubmit",value:function(){var e="&view="+l.view;(l.id&&(e+="&id="+l.id),t.getElementById("com-apps-searchbox").value)&&(e+="&filter_search="+encodeURI(t.getElementById("com-apps-searchbox").value.toLowerCase().replace(/ +/g,"_").replace(/[^a-z0-9-_]/g,"").trim()));""!==l.ordering&&t.getElementById("com-apps-ordering").value&&(l.ordering=t.getElementById("com-apps-ordering").value),l.ordering&&(e+="&ordering="+l.ordering),this.loadweb(l.options.base_url+"index.php?format=json&option=com_apps"+e)}},{key:"processLinkClick",value:function(e){var t=new RegExp(l.options.base_url),i=new RegExp("^index.php");t.test(e)||i.test(e)?(l.view=e.replace(/^.+[&?]view=(\w+).*$/,"$1"),"dashboard"===l.view?l.id=0:"category"===l.view&&(l.id=e.replace(/^.+[&?]id=(\d+).*$/,"$1")),this.loadweb(l.options.base_url+e)):this.loadweb(e)}},{key:"installfromweb",value:function(e,n){if(!e)return alert(i.JText._("PLG_INSTALLER_WEBINSTALLER_CANNOT_INSTALL_EXTENSION_IN_PLUGIN")),!1;var l=t.getElementById("install_url"),a=t.getElementById("uploadform-web-url");(l.value=e,a.innerHTML=e,n)?(t.getElementById("uploadform-web-name").innerHTML=n,t.getElementById("uploadform-web-name-label").classList.remove("hidden")):t.getElementById("uploadform-web-name-label").classList.add("hidden");return t.getElementById("uploadform-web").classList.remove("hidden"),!0}}],[{key:"clicker",value:function(){t.querySelector(".grid-view")&&t.querySelector(".grid-view").addEventListener("click",function(){l.list=0,t.querySelector(".list-container").classList.add("hidden"),t.querySelector(".grid-container").classList.remove("hidden"),t.getElementById("btn-list-view").classList.remove("active"),t.getElementById("btn-grid-view").classList.remove("active")}),t.querySelector(".list-view")&&t.querySelector(".list-view").addEventListener("click",function(){l.list=1,t.querySelector(".grid-container").classList.add("hidden"),t.querySelector(".list-container").classList.remove("hidden"),t.getElementById("btn-grid-view").classList.remove("active"),t.getElementById("btn-list-view").classList.add("active")})}}]),a}();n(function(e){var t=e("#myTabTabs").find('a[href="#web"]');l.options.installfromon&&t.click(),t.hasClass("active")&&(a||(a=new r).initialise()),t.closest("li").click(function(){a||(a=new r).initialise()}),""!==l.options.installfrom_url&&t.closest("li").click(),t.on("shown.bs.tab",function(){a||(a=new r).initialise()})})}(window,document,Joomla,window.jQuery);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L64

Insecure DOM Manipulation (XSS) in extensionupdatecheck.es6.js

CWE-79
File Location: media/plg_quickicon_extensionupdate/js/extensionupdatecheck.es6.js:64
Security Score:
69 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- linkSpan[i].innerHTML = Joomla.JText._('PLG_QUICKICON_EXTENSIONUPDATE_ERROR');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L58

Insecure DOM Manipulation (XSS) in extensionupdatecheck.js

CWE-79
File Location: media/plg_quickicon_extensionupdate/js/extensionupdatecheck.js:58
Security Score:
69 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- linkSpan[_i2].innerHTML = Joomla.JText._('PLG_QUICKICON_EXTENSIONUPDATE_ERROR');
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in extensionupdatecheck.min.js

CWE-79
File Location: media/plg_quickicon_extensionupdate/js/extensionupdatecheck.min.js:1
Security Score:
69 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- !function(){"use strict";document.addEventListener("DOMContentLoaded",function(){if(Joomla.getOptions("js-extensions-update")){var e=Joomla.getOptions("js-extensions-update");Joomla.request({url:e.ajaxUrl+"&eid=0&skip=700",method:"GET",data:"",perform:!0,onSuccess:function(n){var t=document.getElementById("plg_quickicon_extensionupdate"),a=t.querySelectorAll("span.j-links-link"),o=JSON.parse(n);if(o instanceof Array)if(0===o.length){t.classList.add("success");for(var s=0,l=a.length;s<l;s+=1)a[s].innerHTML=Joomla.JText._("PLG_QUICKICON_EXTENSIONUPDATE_UPTODATE")}else{var r={message:[Joomla.JText._("PLG_QUICKICON_EXTENSIONUPDATE_UPDATEFOUND_MESSAGE").replace("%s",'<span class="badge badge-light">'+o.length+"</span>")+'<button class="btn btn-primary" onclick="document.location=\''+e.url+"'\">"+Joomla.JText._("PLG_QUICKICON_EXTENSIONUPDATE_UPDATEFOUND_BUTTON")+"</button>"],error:["info"]};Joomla.renderMessages(r),window.scrollTo(0,0),t.classList.add("danger");for(var i=0,d=a.length;i<d;i+=1)a[i].innerHTML=Joomla.JText._("PLG_QUICKICON_EXTENSIONUPDATE_UPDATEFOUND").replace("%s",'<span class="badge badge-light">'+o.length+"</span>")}else{t.classList.add("danger");for(var c=0,E=a.length;c<E;c+=1)a[c].innerHTML=Joomla.JText._("PLG_QUICKICON_EXTENSIONUPDATE_ERROR")}},onError:function(){var e=document.getElementById("plg_quickicon_extensionupdate"),n=e.querySelectorAll("span.j-links-link");e.classList.add("danger");for(var t=0,a=n.length;t<a;t+=1)n[t].innerHTML=Joomla.JText._("PLG_QUICKICON_EXTENSIONUPDATE_ERROR")}})}})}();
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L351

Insecure DOM Manipulation (XSS) in calendar.js

CWE-79
File Location: media/system/js/fields/calendar.js:351
Security Score:
69 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- if (el.navtype === 50) { el._current = el.innerHTML; }
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L695

Insecure DOM Manipulation (XSS) in calendar.js

CWE-79
File Location: media/system/js/fields/calendar.js:695
Security Score:
69 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- cell.innerHTML = " ";
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L336

Insecure DOM Manipulation (XSS) in searchtools.js

CWE-79
File Location: media/system/js/searchtools.js:336
Security Score:
69 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- this.theForm.innerHTML+= this.orderField.outerHTML;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L184

Insecure DOM Manipulation (XSS) in joomla-field-media-es5.js

CWE-79
File Location: media/system/webcomponents/js/joomla-field-media-es5.js:184
Security Score:
69 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- div.innerHTML = '';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in joomla-tab-es5.min.js

CWE-79
File Location: media/system/webcomponents/js/joomla-tab-es5.min.js:1
Security Score:
69 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- !function(){return function t(e,r,i){function n(o,s){if(!r[o]){if(!e[o]){var c="function"==typeof require&&require;if(!s&&c)return c(o,!0);if(a)return a(o,!0);var u=new Error("Cannot find module '"+o+"'");throw u.code="MODULE_NOT_FOUND",u}var l=r[o]={exports:{}};e[o][0].call(l.exports,function(t){var r=e[o][1][t];return n(r||t)},l,l.exports,t,e,r,i)}return r[o].exports}for(var a="function"==typeof require&&require,o=0;o<i.length;o++)n(i[o]);return n}}()({1:[function(t,e,r){"use strict";var i=function(){function t(t,e){for(var r=0;r<e.length;r++){var i=e[r];i.enumerable=i.enumerable||!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}return function(e,r,i){return r&&t(e.prototype,r),i&&t(e,i),e}}();customElements.define("joomla-tab",function(t){function e(){!function(t,e){if(!(t instanceof e))throw new TypeError("Cannot call a class as a function")}(this,e);var t=function(t,e){if(!t)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return!e||"object"!=typeof e&&"function"!=typeof e?t:e}(this,(e.__proto__||Object.getPrototypeOf(e)).call(this));return t.hasActive=!1,t.currentActive="",t.hasNested=!1,t.isNested=!1,t.tabs=[],t}return function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Super expression must either be null or a function, not "+typeof e);t.prototype=Object.create(e&&e.prototype,{constructor:{value:t,enumerable:!1,writable:!0,configurable:!0}}),e&&(Object.setPrototypeOf?Object.setPrototypeOf(t,e):t.__proto__=e)}(e,HTMLElement),i(e,[{key:"recall",get:function(){return this.getAttribute("recall")}},{key:"view",get:function(){return this.getAttribute("view")},set:function(t){this.setAttribute("view",t)}},{key:"orientation",get:function(){return this.getAttribute("orientation")},set:function(t){this.setAttribute("oriendation",t)}}],[{key:"observedAttributes",get:function(){return["recall","orientation","view"]}}]),i(e,[{key:"connectedCallback",value:function(){var t=this;(!this.orientation||this.orientation&&-1===["horizontal","vertical"].indexOf(this.orientation))&&(this.orientation="horizontal");var e=this,r=[].slice.call(this.querySelectorAll("section")),i=[],n=[];if(r){if(this.findAncestor(this,"joomla-tab")&&(this.isNested=!0),this.querySelector("joomla-tab")&&(this.hasNested=!0),this.hasAttribute("recall")){var a=sessionStorage.getItem(this.getStorageKey());a&&n.push(a)}if(this.hasNested){var o=sessionStorage.getItem(this.getStorageKey());if(o&&n.push(o),console.log(n),n.length&&""!==n[0]){var s=n[0].substring(5),c=this.querySelector("#"+s);if(c){var u=this.findAncestor(c,"joomla-tab");if(this.findAncestor(u,"joomla-tab")){var l=this.findAncestor(u,"section");l&&n.push("#tab-"+l.id)}}}r.forEach(function(t){if(n.length){var r="#tab-"+t.id;-1===n.indexOf(r)?t.removeAttribute("active"):t.setAttribute("active","")}t.parentNode===e&&i.push(t)})}else r.forEach(function(t){if(n.length){var e="#tab-"+t.hash;n.indexOf(e)>-1?t.removeAttribute("active"):t.setAttribute("active","")}}),i=r;if("accordion"!==this.view&&this.createNavigation(i),i.forEach(function(e){e.setAttribute("role","tabpanel"),t.tabs.push("#tab-"+e.id),e.hasAttribute("active")&&(t.hasActive=!0,t.currentActive=e.id,t.querySelector("#tab-"+e.id).setAttribute("aria-selected","true"),t.querySelector("#tab-"+e.id).setAttribute("active",""),t.querySelector("#tab-"+e.id).setAttribute("tabindex","0"))}),this.hasActive||(i[0].setAttribute("active",""),this.hasActive=!0,this.currentActive=i[0].id,this.querySelector("#tab-"+i[0].id).setAttribute("aria-selected","true"),this.querySelector("#tab-"+i[0].id).setAttribute("tabindex","0"),this.querySelector("#tab-"+i[0].id).setAttribute("active","")),window.location.href.match(/#\S[^&]*/)){var h=window.location.href.match(/#\S[^&]*/),d=this.querySelector(h[0]);if(d){var f=this.findAncestor(d,"joomla-tab"),v=this.findAncestor(f,"joomla-tab");if(v){var b=this.findAncestor(f,"section");v.showTab(b),this.show(d)}else this.showTab(d)}}window.addEventListener("resize",function(){e.checkView(e)})}}},{key:"disconnectedCallback",value:function(){var t=this,e=this.querySelector("ul");[].slice.call(e.querySelectorAll("a")).forEach(function(e){e.removeEventListener("click",t)}),e.removeEventListener("keydown",this)}},{key:"createNavigation",value:function(t){var e=this;if("ul"!==this.firstElementChild.nodeName.toLowerCase()){var r=document.createElement("ul");r.setAttribute("role","tablist");var i=function(t){t.preventDefault(),e.hasActive&&e.hideCurrent();var r=e.currentActive;e.dispatchCustomEvent("joomla.tab.show",t.target,e.querySelector("#tab-"+r)),t.target.setAttribute("active",""),t.target.setAttribute("aria-selected","true"),t.target.setAttribute("tabindex","0"),e.querySelector(t.target.hash).setAttribute("active",""),e.querySelector(t.target.hash).removeAttribute("aria-hidden"),e.currentActive=t.target.hash.substring(1),e.dispatchCustomEvent("joomla.tab.shown",t.target,e.querySelector("#tab-"+r)),e.saveState("#tab-"+t.target.hash.substring(1))};t.forEach(function(t){if(t.id){var e=t.hasAttribute("active"),n=document.createElement("li"),a=document.createElement("a");n.setAttribute("role","presentation"),a.setAttribute("role","tab"),a.setAttribute("aria-controls",t.id),a.setAttribute("aria-selected",e?"true":"false"),a.setAttribute("tabindex",e?"0":"-1"),a.setAttribute("href","#"+t.id),a.setAttribute("id","tab-"+t.id),a.innerHTML=t.getAttribute("name"),e&&a.setAttribute("active",""),a.addEventListener("click",i),n.append(a),r.append(n),t.setAttribute("aria-labelledby","tab-"+t.id),e||t.setAttribute("aria-hidden","true")}}),this.insertAdjacentElement("afterbegin",r),this.addKeyListeners()}}},{key:"hideCurrent",value:function(){if(this.currentActive){var t=this.querySelector('a[aria-controls="'+this.currentActive+'"]');this.dispatchCustomEvent("joomla.tab.hide",t,this.querySelector("#tab-"+this.currentActive)),t.removeAttribute("active"),t.setAttribute("tabindex","-1"),this.querySelector("#"+this.currentActive).removeAttribute("active"),this.querySelector("#"+this.currentActive).setAttribute("aria-hidden","true"),t.removeAttribute("aria-selected"),this.dispatchCustomEvent("joomla.tab.hidden",t,this.querySelector("#tab-"+this.currentActive))}}},{key:"showTab",value:function(t){document.querySelector("#tab-"+t.id).click()}},{key:"show",value:function(t){t.click()}},{key:"addKeyListeners",value:function(){var t=this;this.querySelector("ul").addEventListener("keyup",function(e){var r=t.querySelector("#tab-"+t.currentActive),i=r.parentNode.previousElementSibling||r.parentNode.parentNode.lastElementChild,n=r.parentNode.nextElementSibling||r.parentNode.parentNode.firstElementChild;if(!e.metaKey&&!e.altKey&&-1!==t.tabs.indexOf("#"+document.activeElement.id))switch(e.keyCode){case 37:case 38:i.querySelector("a").click(),i.querySelector("a").focus(),e.preventDefault();break;case 39:case 40:n.querySelector("a").click(),n.querySelector("a").focus(),e.preventDefault()}})}},{key:"getStorageKey",value:function(){return window.location.href.toString().split(window.location.host)[1].replace(/&return=[a-zA-Z0-9%]+/,"").split("#")[0]}},{key:"saveState",value:function(t){var e=this.getStorageKey();sessionStorage.setItem(e,t)}},{key:"checkView",value:function(t){var e=t.querySelector("ul"),r=[];if(document.body.getBoundingClientRect().width>920){if("tabs"===this.view)return;t.view="tabs";for(var i=[].slice.call(e.querySelectorAll("section")),n=0,a=i.length;n<a;++n)i[n].parentNode.parentNode.parentNode===t&&r.push(i[n]);r.length&&r.forEach(function(e){t.appendChild(e)})}else{if("accordion"===this.view)return;t.view="accordion";for(var o=[].slice.call(t.querySelectorAll("section")),s=0,c=o.length;s<c;++s)o[s].parentNode===t&&r.push(o[s]);r.length&&r.forEach(function(e){var r=t.querySelector('a[aria-controls="'+e.id+'"]');r.parentNode.parentNode===t.firstElementChild&&r.parentNode.appendChild(e)})}}},{key:"findAncestor",value:function(t,e){for(;(t=t.parentElement)&&t.nodeName.toLowerCase()!==e;);return t}},{key:"dispatchCustomEvent",value:function(t,e,r){var i=new CustomEvent(t,{bubbles:!0,cancelable:!0});i.relatedTarget=r,e.dispatchEvent(i),e.removeEventListener(t,e)}}]),e}())},{}]},{},[1]);
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L1

Insecure DOM Manipulation (XSS) in joomla-tab.min.js

CWE-79
File Location: media/system/webcomponents/js/joomla-tab.min.js:1
Security Score:
69 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- customElements.define("joomla-tab",class extends HTMLElement{static get observedAttributes(){return["recall","orientation","view"]}get recall(){return this.getAttribute("recall")}get view(){return this.getAttribute("view")}set view(t){this.setAttribute("view",t)}get orientation(){return this.getAttribute("orientation")}set orientation(t){this.setAttribute("oriendation",t)}constructor(){super(),this.hasActive=!1,this.currentActive="",this.hasNested=!1,this.isNested=!1,this.tabs=[]}connectedCallback(){(!this.orientation||this.orientation&&-1===["horizontal","vertical"].indexOf(this.orientation))&&(this.orientation="horizontal");const t=this,e=[].slice.call(this.querySelectorAll("section"));let i=[],r=[];if(e){if(this.findAncestor(this,"joomla-tab")&&(this.isNested=!0),this.querySelector("joomla-tab")&&(this.hasNested=!0),this.hasAttribute("recall")){const t=sessionStorage.getItem(this.getStorageKey());t&&r.push(t)}if(this.hasNested){const s=sessionStorage.getItem(this.getStorageKey());if(s&&r.push(s),console.log(r),r.length&&""!==r[0]){const t=r[0].substring(5),e=this.querySelector(`#${t}`);if(e){const t=this.findAncestor(e,"joomla-tab");if(this.findAncestor(t,"joomla-tab")){const e=this.findAncestor(t,"section");e&&r.push(`#tab-${e.id}`)}}}e.forEach(e=>{if(r.length){const t=`#tab-${e.id}`;-1===r.indexOf(t)?e.removeAttribute("active"):e.setAttribute("active","")}e.parentNode===t&&i.push(e)})}else e.forEach(t=>{if(r.length){const e=`#tab-${t.hash}`;r.indexOf(e)>-1?t.removeAttribute("active"):t.setAttribute("active","")}}),i=e;if("accordion"!==this.view&&this.createNavigation(i),i.forEach(t=>{t.setAttribute("role","tabpanel"),this.tabs.push(`#tab-${t.id}`),t.hasAttribute("active")&&(this.hasActive=!0,this.currentActive=t.id,this.querySelector(`#tab-${t.id}`).setAttribute("aria-selected","true"),this.querySelector(`#tab-${t.id}`).setAttribute("active",""),this.querySelector(`#tab-${t.id}`).setAttribute("tabindex","0"))}),this.hasActive||(i[0].setAttribute("active",""),this.hasActive=!0,this.currentActive=i[0].id,this.querySelector(`#tab-${i[0].id}`).setAttribute("aria-selected","true"),this.querySelector(`#tab-${i[0].id}`).setAttribute("tabindex","0"),this.querySelector(`#tab-${i[0].id}`).setAttribute("active","")),window.location.href.match(/#\S[^&]*/)){const t=window.location.href.match(/#\S[^&]*/),e=this.querySelector(t[0]);if(e){const t=this.findAncestor(e,"joomla-tab"),i=this.findAncestor(t,"joomla-tab");if(i){const r=this.findAncestor(t,"section");i.showTab(r),this.show(e)}else this.showTab(e)}}window.addEventListener("resize",()=>{t.checkView(t)})}}disconnectedCallback(){const t=this.querySelector("ul");[].slice.call(t.querySelectorAll("a")).forEach(t=>{t.removeEventListener("click",this)}),t.removeEventListener("keydown",this)}createNavigation(t){if("ul"===this.firstElementChild.nodeName.toLowerCase())return;const e=document.createElement("ul");e.setAttribute("role","tablist");const i=t=>{t.preventDefault(),this.hasActive&&this.hideCurrent();const e=this.currentActive;this.dispatchCustomEvent("joomla.tab.show",t.target,this.querySelector(`#tab-${e}`)),t.target.setAttribute("active",""),t.target.setAttribute("aria-selected","true"),t.target.setAttribute("tabindex","0"),this.querySelector(t.target.hash).setAttribute("active",""),this.querySelector(t.target.hash).removeAttribute("aria-hidden"),this.currentActive=t.target.hash.substring(1),this.dispatchCustomEvent("joomla.tab.shown",t.target,this.querySelector(`#tab-${e}`)),this.saveState(`#tab-${t.target.hash.substring(1)}`)};t.forEach(t=>{if(!t.id)return;const r=t.hasAttribute("active"),s=document.createElement("li"),a=document.createElement("a");s.setAttribute("role","presentation"),a.setAttribute("role","tab"),a.setAttribute("aria-controls",t.id),a.setAttribute("aria-selected",r?"true":"false"),a.setAttribute("tabindex",r?"0":"-1"),a.setAttribute("href",`#${t.id}`),a.setAttribute("id",`tab-${t.id}`),a.innerHTML=t.getAttribute("name"),r&&a.setAttribute("active",""),a.addEventListener("click",i),s.append(a),e.append(s),t.setAttribute("aria-labelledby",`tab-${t.id}`),r||t.setAttribute("aria-hidden","true")}),this.insertAdjacentElement("afterbegin",e),this.addKeyListeners()}hideCurrent(){if(this.currentActive){const t=this.querySelector(`a[aria-controls="${this.currentActive}"]`);this.dispatchCustomEvent("joomla.tab.hide",t,this.querySelector(`#tab-${this.currentActive}`)),t.removeAttribute("active"),t.setAttribute("tabindex","-1"),this.querySelector(`#${this.currentActive}`).removeAttribute("active"),this.querySelector(`#${this.currentActive}`).setAttribute("aria-hidden","true"),t.removeAttribute("aria-selected"),this.dispatchCustomEvent("joomla.tab.hidden",t,this.querySelector(`#tab-${this.currentActive}`))}}showTab(t){document.querySelector(`#tab-${t.id}`).click()}show(t){t.click()}addKeyListeners(){this.querySelector("ul").addEventListener("keyup",t=>{const e=this.querySelector(`#tab-${this.currentActive}`),i=e.parentNode.previousElementSibling||e.parentNode.parentNode.lastElementChild,r=e.parentNode.nextElementSibling||e.parentNode.parentNode.firstElementChild;if(!t.metaKey&&!t.altKey&&-1!==this.tabs.indexOf(`#${document.activeElement.id}`))switch(t.keyCode){case 37:case 38:i.querySelector("a").click(),i.querySelector("a").focus(),t.preventDefault();break;case 39:case 40:r.querySelector("a").click(),r.querySelector("a").focus(),t.preventDefault()}})}getStorageKey(){return window.location.href.toString().split(window.location.host)[1].replace(/&return=[a-zA-Z0-9%]+/,"").split("#")[0]}saveState(t){const e=this.getStorageKey();sessionStorage.setItem(e,t)}checkView(t){const e=t.querySelector("ul");let i=[];if(document.body.getBoundingClientRect().width>920){if("tabs"===this.view)return;t.view="tabs";const r=[].slice.call(e.querySelectorAll("section"));for(let e=0,s=r.length;e<s;++e)r[e].parentNode.parentNode.parentNode===t&&i.push(r[e]);i.length&&i.forEach(e=>{t.appendChild(e)})}else{if("accordion"===this.view)return;t.view="accordion";const e=[].slice.call(t.querySelectorAll("section"));for(let r=0,s=e.length;r<s;++r)e[r].parentNode===t&&i.push(e[r]);i.length&&i.forEach(e=>{const i=t.querySelector('a[aria-controls="'+e.id+'"]');i.parentNode.parentNode===t.firstElementChild&&i.parentNode.appendChild(e)})}}findAncestor(t,e){for(;(t=t.parentElement)&&t.nodeName.toLowerCase()!==e;);return t}dispatchCustomEvent(t,e,i){const r=new CustomEvent(t,{bubbles:!0,cancelable:!0});r.relatedTarget=i,e.dispatchEvent(r),e.removeEventListener(t,e)}});
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output