Dev

applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Web/Views/Shared/Components/Scoresheet/Default.cshtml

@@ -1,6 +1,5 @@
 @using Microsoft.AspNetCore.Mvc.Localization
 @using Unity.Flex.Localization;
-@using Unity.Flex.Web.Views.Shared.Components.Scoresheet;
 @using Volo.Abp.Authorization.Permissions;
 @inject IHtmlLocalizer<FlexResource> L
 @inject IPermissionChecker PermissionChecker
@@ -99,7 +98,8 @@
                                         data-maxlength="@question.GetMaxLength()" 
                                         data-yesvalue="@question.GetYesValue()" 
                                         data-novalue="@question.GetNoValue()" 
-                                        data-questiondesc="@question.Description" 
+                                        data-questionlabel="@question.Label"
+                                        data-questiondesc="@question.Description"
                                         data-definition="@question.Definition"
                                         data-rows="@question.GetRowsValue()"
                                         data-required="@question.GetIsRequiredValue()">

applications/Unity.GrantManager/modules/Unity.Flex/src/Unity.Flex.Web/Views/Shared/Components/Scoresheet/Scoresheet.js

@@ -1,3 +1,63 @@
+const _SANITIZE_ALLOWED_TAGS = new Set([
+    'a', 'b', 'blockquote', 'br', 'code', 'del', 'em',
+    'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i',
+    'li', 'ol', 'p', 'pre', 's', 'span', 'strong', 'u', 'ul'
+]);
+const _SANITIZE_ALLOWED_ATTRS = new Set(['href', 'rel', 'target', 'title']);
+const _SANITIZE_ALLOWED_SCHEMES = new Set(['http:', 'https:', 'mailto:']);
+const _SANITIZE_STRIP_WITH_CONTENT = new Set(['script', 'style', 'iframe', 'noscript', 'object', 'embed']);
+
+function _isSafeHref(href) {
+    try {
+        const url = new URL(href, location.href);
+        return _SANITIZE_ALLOWED_SCHEMES.has(url.protocol);
+    } catch (e) {
+        console.warn('sanitizeHtml: invalid href removed:', e);
+        return false;
+    }
+}
+
+function _sanitizeElement(el) {
+    for (const attr of Array.from(el.attributes)) {
+        if (_SANITIZE_ALLOWED_ATTRS.has(attr.name)) {
+            if (attr.name === 'href' && !_isSafeHref(el.getAttribute('href'))) {
+                el.removeAttribute('href');
+            }
+        } else {
+            el.removeAttribute(attr.name);
+        }
+    }
+}
+
+function sanitizeHtml(html) {
+    if (!html) return '';
+    const template = document.createElement('template');
+    template.innerHTML = html;
+    // Process bottom-up so children are handled before their parent is unwrapped/removed
+    const elements = Array.from(template.content.querySelectorAll('*')).reverse();
+    for (const el of elements) {
+        const tag = el.tagName.toLowerCase();
+        if (_SANITIZE_STRIP_WITH_CONTENT.has(tag)) {
+            el.remove();
+        } else if (_SANITIZE_ALLOWED_TAGS.has(tag)) {
+            _sanitizeElement(el);
+        } else {
+            el.replaceWith(...Array.from(el.childNodes));
+        }
+    }
+    const wrapper = document.createElement('div');
+    wrapper.appendChild(template.content);
+    return wrapper.innerHTML;
+}
+
+function escapeHtml(text) {
+    return String(text)
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;');
+}
+
 $(function () {
 
     function makeScoresheetsSortable() {
@@ -149,7 +209,7 @@ $(function () {
                 <form method="post" id="section-form-${hashCode(item.innerText)}" onSubmit="return false;">
                 <h2 class="accordion-header" id="panel-${hashCode(item.innerText)}">
                     <button class="accordion-button preview-btn unt-accordion-button" type="button" data-bs-toggle="collapse" data-bs-target="#collapse-${hashCode(item.innerText)}" aria-expanded="true" aria-controls="collapse-${hashCode(item.innerText)}">
-                        ${sectionNumber}.  ${item.dataset.label}
+                        ${sectionNumber}.  ${escapeHtml(item.dataset.label)}
                     </button>
                 </h2>
                 <div id="collapse-${hashCode(item.innerText)}" class="accordion-collapse collapse show" aria-labelledby="panel-${hashCode(item.innerText)}">
@@ -163,7 +223,7 @@ $(function () {
                     <div class="accordion-item">
                         <h2 class="accordion-header" id="nested-panel${hashCode(item.innerText)}">
                             <button class="accordion-button question-btn collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#nested-collapse${hashCode(item.innerText)}" aria-expanded="true" aria-controls="nested-collapse${hashCode(item.innerText)}">
-                                ${sectionNumber}.${questionNumber}  ${item.innerText} ${item.dataset.required == 'True' ? '*' : ''}
+                                ${sectionNumber}.${questionNumber}  ${sanitizeHtml(item.dataset.questionlabel)} ${item.dataset.required == 'True' ? '*' : ''}
                             </button>
                         </h2>
                         <div id="nested-collapse${hashCode(item.innerText)}" class="accordion-collapse collapse" aria-labelledby="nested-panel${hashCode(item.innerText)}">
@@ -219,7 +279,7 @@ $(function () {
     function buildTextAreaFieldPreview(item) {
         let req = item.dataset.required ? "required" : null;
         return `
-                    <p>${item.dataset.questiondesc}</p>
+                    <p>${sanitizeHtml(item.dataset.questiondesc)}</p>
                     <div class="mb-3">
                         <label for="answer-text-${item.dataset.id}" class="form-label unt-form-label">Answer</label>
                         <textarea rows="${item.dataset.rows}" type="text" ${req} class="form-control answer-text-input" minlength="${item.dataset.minlength}" maxlength="${item.dataset.maxlength}" 
@@ -238,7 +298,7 @@ $(function () {
         }).join('');
 
         return `
-                    <p>${item.dataset.questiondesc}</p>
+                    <p>${sanitizeHtml(item.dataset.questiondesc)}</p>
                     <div class="mb-3">
                         <label for="answer-selectlist-${item.dataset.id}" class="form-label unt-form-label">Answer</label>
                         <select id="answer-selectlist-${item.dataset.id}"
@@ -254,7 +314,7 @@ $(function () {
     function buildNumberFieldPreview(item) {
         let req = item.dataset.required ? "required" : null;
         return `
-                    <p>${item.dataset.questiondesc}</p>
+                    <p>${sanitizeHtml(item.dataset.questiondesc)}</p>
                     <div class="mb-3">
                         <label for="answer-number-${item.dataset.id}" class="form-label unt-form-label">Answer</label>
                         <input type="number" ${req} class="form-control answer-number-input" min="${item.dataset.min}" max="${item.dataset.max}" 
@@ -266,7 +326,7 @@ $(function () {
 
     function buildYesNoFieldPreview(item) {
         return `
-                    <p>${item.dataset.questiondesc}</p>
+                    <p>${sanitizeHtml(item.dataset.questiondesc)}</p>
                     <div class="mb-3">
                         <label for="answer-yesno-${item.dataset.id}" class="form-label unt-form-label">Answer</label>
                         <select id="answer-yesno-${item.dataset.id}"
@@ -287,7 +347,7 @@ $(function () {
         let req = item.dataset.required ? "required" : null;
 
         return `
-                    <p>${item.dataset.questiondesc}</p>
+                    <p>${sanitizeHtml(item.dataset.questiondesc)}</p>
                     <div class="mb-3">
                         <label for="answer-text-${item.dataset.id}" class="form-label unt-form-label">Answer</label>
                         <input type="text" ${req} class="form-control answer-text-input" minlength="${item.dataset.minlength}" maxlength="${item.dataset.maxlength}" 

applications/Unity.GrantManager/modules/Unity.Flex/test/Unity.Flex.Application.Tests/Unity.Flex.Application.Tests.csproj

@@ -18,6 +18,8 @@
 	  <PackageReference Include="Volo.Abp.EntityFrameworkCore.Sqlite" Version="10.3.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.Application" Version="10.3.0" />
     <PackageReference Include="Volo.Abp.SettingManagement.Domain" Version="10.3.0" />
+    <!-- Explicit reference to fix vulnerable transitive dependency -->
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
   </ItemGroup>
 
   <ItemGroup>

applications/Unity.GrantManager/modules/Unity.Identity.Web/src/Pages/Identity/Roles/PermissionRoleMatrix.cshtml.cs

@@ -1,14 +1,17 @@
+using Microsoft.AspNetCore.Authorization;
 using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
 using Unity.GrantManager.Repositories;
 using Volo.Abp.AspNetCore.Mvc.UI.RazorPages;
 using Volo.Abp.Authorization.Permissions;
+using Volo.Abp.Identity;
 using Volo.Abp.Localization;
 
 namespace Unity.GrantManager.Web.Pages.Identity.Roles;
 
+[Authorize(IdentityPermissions.Roles.Default)]
 public class PermissionRoleMatrixModel(IPermissionRoleMatrixRepository repository, IPermissionDefinitionManager permissionDefinitionManager) : AbpPageModel
 {
     public bool IsExpanded { get; private set; }

applications/Unity.GrantManager/modules/Unity.Identity.Web/src/Pages/Identity/Roles/PermissionRoleMatrix.js

@@ -1,5 +1,5 @@
 $(document).ready(function () {
-    const urlParams = new URLSearchParams(window.location.search);
+    const urlParams = new URLSearchParams(globalThis.location.search);
     const isExpanded = urlParams.get('Render') === 'Expanded';
     const exportTitle = `${abp.currentTenant.name}_${(new Date()).toISOString().slice(0, 10)}_Permission-Role Matrix`;
 
@@ -11,7 +11,7 @@
     );
     _permissionsModal.onClose(function () {
         // Refresh the page to show updated permissions
-        window.location.reload();
+        globalThis.location.reload();
     });
 
     const roleColumnIndexes = [];
@@ -34,6 +34,16 @@
         });
     }
 
+    const adjustTableLayout = function () {
+        globalThis.requestAnimationFrame(function () {
+            localTable.columns.adjust();
+
+            if (localTable.fixedHeader) {
+                localTable.fixedHeader.adjust();
+            }
+        });
+    };
+
     $.fn.dataTable.Buttons.defaults.dom.button.className = 'btn flex-none';
     let localTable = $('#permissionTable').DataTable({
         paging: false,
@@ -55,7 +65,7 @@
                     : '<i class="fl fl-fullscreen align-middle"></i> <span>View Expanded</span>',
                 className: 'btn-light rounded-1',
                 action: function (e, dt, button, config) {
-                    window.location = isExpanded
+                    globalThis.location = isExpanded
                         ? '/Identity/Roles/PermissionRoleMatrix'
                         : '/Identity/Roles/PermissionRoleMatrix?Render=Expanded';
                 }
@@ -122,6 +132,11 @@
     // Hide spinner and show table after initialization
     $('.loading-spinner').hide();
     $('#permissionTable').show();
+    adjustTableLayout();
+
+    $(globalThis).on('resize', function () {
+        adjustTableLayout();
+    });
 
     // Add click handlers to role column headers using data-role-header attribute
     $(document).on('click', 'th[data-role-header]', function () {

applications/Unity.GrantManager/modules/Unity.Identity.Web/src/Pages/Identity/Roles/index.js

@@ -123,8 +123,9 @@ $(function () {
         {
             text: '<i class="fl fl-multi-select align-middle"></i><span>View Role Matrix</span>',
             className: 'btn-light rounded-1',
+            available: () => abp.auth.isGranted('AbpIdentity.Roles'),
             action: function (e, dt, button, config) {
-                window.location = '/Identity/Roles/PermissionRoleMatrix'
+                globalThis.location = '/Identity/Roles/PermissionRoleMatrix'
             }
         },
         {