fix(webapp): close js/xss on the framework-control deep link

[emmanuelgjr]

What

Closes a DOM XSS (CodeQL js/xss class) on the framework-control deep link in docs/index.html, the hand-maintained single-page app (scripts/generate.js only writes the docs/*.js data bundles, so this edit is not regenerated away).

Why: the taint flow

window.location.hash                         getRoute()
  -> path
  -> fwControlMatch = path.match(/^\/frameworks\/([^/]+)\/(.+)$/)
  -> decodeURIComponent(match[1] | match[2])   fwNameCtrl, ctrlId
  -> renderControlDetail(app, fwNameCtrl, ctrlId)
  -> el(..., fwName | controlId)
  -> node.appendChild(c)                        <- sink

The sibling frameworkMatch route immediately below already allow-lists its input with FRAMEWORKS.indexOf(fwName) !== -1. The fwControlMatch branch had no equivalent.

No code-scanning analysis exists on this repo yet (code-scanning/alerts returns no analysis found), so there are no alert numbers to reference here; the same flow was flagged as alerts #3 and #4 in the monorepo.

Changes

1. resolveControlId(fwName, controlId) looks the control id up in the same three places renderControlDetail reads (framework registry, backlink index, DATA mappings) and returns the stored string. The route checks the framework name against FRAMEWORKS, then renders only the resolved values, never URL text. A link that resolves to nothing falls through to the frameworks index. Adapted for this repo: the registry and backlink lookups use hasOwnProperty, so prototype keys can never match.
2. el() only appends real nodes. Children go through toNode(), which returns a DOM node unchanged and wraps anything else in a text node. Before, a string inside an array made appendChild throw.

An exact allow-list from our own data is used instead of a character filter. Control ids are full of punctuation (GV-1.7, Art. 24-27, A.5.1), and CodeQL does not treat a negated character-class check as a sanitizer.

Verification

• Inline <script> parses with vm.Script: 0 syntax errors.
• Every deep link the app builds still resolves to itself (checked with the route code taken from the edited file, run against the real bundles):

Source	Unique links	Broken
backlinks.js	1159	0
frameworks-registry.js controls (incl. parent/child links)	1514	0
data.js mappings	1159	0
classifier-predictions.js (review page)	199	0

• Payloads resolve to null and fall through, whether used as the control id, the framework name, or both, encoded or raw: <img src=x onerror=alert(1)>, "><svg/onload=alert(1)>, <script>alert(1)</script>, __proto__, constructor. 25 checks, 0 resolved.
• el() tested with a DOM shim, 7/7 pass: a string child becomes textContent; an array holding a string gives a text node and no longer throws; element identity is kept; falsy entries are skipped; a number becomes a text node.
• Repo checks give the same results on this branch and on main:
  • node scripts/validate.js: 0 errors, 84 warnings, 312 passed.
  • npm run stats:check: current.
  • node --test scripts/*.test.mjs: 50/50.
  • node scripts/generate.js: the only drift is the // Generated: date header.

Ported from GenAI-Security-Project/GenAI-Data-Security-Initiative#63 (that copy of crosswalk/ has since been removed)

🤖 Generated with Claude Code

https://claude.ai/code/session_01KJVKF6raJCNKBWjTkDSqR4