CodeQL alerts #22 and #23 (rated High) point at vendor/leaflet-gpx/gpx.js line 143. The two .replace() calls in get_duration_string_iso each take a string argument, so only the first occurrence is replaced. The current upstream formatter only emits one of each character; the High rating comes from the pattern being unsafe if its output ever reaches an HTML interpolation sink.
Patch proposed upstream in mpetazzoni/leaflet-gpx#186. When it merges and we re-vendor, the alerts will close.
CodeQL alerts #22 and #23 (rated High) point at
vendor/leaflet-gpx/gpx.jsline 143. The two.replace()calls inget_duration_string_isoeach take a string argument, so only the first occurrence is replaced. The current upstream formatter only emits one of each character; the High rating comes from the pattern being unsafe if its output ever reaches an HTML interpolation sink.Patch proposed upstream in mpetazzoni/leaflet-gpx#186. When it merges and we re-vendor, the alerts will close.