fix(crosswalk): render resolved control ids, never the URL text

CodeQL still reported js/xss after the first pass. The SARIF flow showed
the FRAMEWORKS allow-list did cut the framework-name path, but two things
were not barriers it recognises:

  * isPlausibleControlId used a negated character class (!/[<>]/.test),
    and CodeQL models positive anchored matches, not negations
  * toNode returned its argument unchanged on the node branch, so taint
    flowed straight back out to appendChild

Replace the character check with resolution. resolveControlId looks the
id up in the same three places renderControlDetail reads - the framework
registry, the backlink index, then DATA mappings - and returns the stored
string. The route renders the resolved value and the allow-listed
framework name, so no URL-derived string reaches the DOM at all. An id
that resolves to nothing falls through to the frameworks index, which is
all an unmatched id could have rendered anyway.

Verified every real deep link still resolves to itself:
  1097/1097 backlink, 1514 registry, 3210 DATA mapping links, 0 broken.
Payloads and __proto__/constructor keys all resolve to null.

Author: emmanuelgjr

crosswalk/docs/index.html

@@ -1642,14 +1642,28 @@
     '/review': renderReview
   };
 
-  // Control ids are drawn from 25 separate framework registries and are
-  // punctuation-heavy ("GV-1.7", "Art. 24-27", "A.5.1"), so this bounds the
-  // length and rejects markup delimiters rather than allow-listing a shape
-  // that would reject legitimate ids.
-  function isPlausibleControlId(value) {
-    return typeof value === 'string' &&
-      value.length > 0 && value.length <= 200 &&
-      !/[<>]/.test(value);
+  // Resolve a control id supplied in the URL to the canonical string held in
+  // our own data, searching the same three places renderControlDetail reads:
+  // the framework registry, the backlink index, then the mappings in DATA.
+  // Returns null when nothing matches. Callers render the returned value
+  // rather than the URL, so nothing user-supplied is ever put on the page —
+  // a control id that matches nothing could only have produced an empty page
+  // echoing the URL back anyway.
+  function resolveControlId(fwName, controlId) {
+    var regFw = FW_REGISTRY_MAP[fwName];
+    if (regFw) {
+      var regControl = (regFw.controls || []).find(function(c) { return c.control_id === controlId; });
+      if (regControl) return regControl.control_id;
+    }
+    var bl = BACKLINK_MAP[fwName + '::' + controlId];
+    if (bl) return bl.control_id;
+    var found = null;
+    DATA.forEach(function(e) {
+      (e.mappings || []).forEach(function(m) {
+        if (found === null && m.framework === fwName && m.control_id === controlId) found = m.control_id;
+      });
+    });
+    return found;
   }
 
   function getRoute() {
@@ -1687,14 +1701,19 @@
     if (fwControlMatch) {
       var fwNameCtrl = decodeURIComponent(fwControlMatch[1]);
       var ctrlId = decodeURIComponent(fwControlMatch[2]);
-      // Apply the same allow-list the plain framework route uses below. An
-      // unknown framework name has no registry entry and no mappings, so it
-      // could only ever render an empty page echoing the URL back; fall
-      // through to the frameworks index instead.
-      if (FRAMEWORKS.indexOf(fwNameCtrl) !== -1 && isPlausibleControlId(ctrlId)) {
-        renderControlDetail(app, fwNameCtrl, ctrlId);
-        window.scrollTo(0, 0);
-        return;
+      // Resolve both halves of the deep link against our own data and render
+      // the resolved values, never the URL text. The framework name gets the
+      // same allow-list the plain framework route uses below; an unknown
+      // framework or control falls through to the frameworks index.
+      var fwIdx = FRAMEWORKS.indexOf(fwNameCtrl);
+      if (fwIdx !== -1) {
+        var knownFw = FRAMEWORKS[fwIdx];
+        var knownCtrl = resolveControlId(knownFw, ctrlId);
+        if (knownCtrl !== null) {
+          renderControlDetail(app, knownFw, knownCtrl);
+          window.scrollTo(0, 0);
+          return;
+        }
       }
     }
     // Framework detail is a full page, not a modal