intersoftdatalabs-in · natechadwick · Aug 28, 2026 · Aug 28, 2026 · Aug 28, 2026 · Aug 28, 2026
diff --git a/README.md b/README.md
@@ -28,11 +28,11 @@ Intersoft Data Labs assumed full responsibility for support, maintenance, and on
 
 ## Current Status (August 2026)
 
-| Version / line | Status | Notes |
-|----------------|--------|--------|
-| **8.1.7** | Current stable release on this repo | Security hardening, WCAG-oriented accessibility work, Google Analytics 4, REST fixes, and ongoing 8.1.x maintenance |
-| **8.1.x (`main`)** | Active maintenance (this repository) | JDK **1.8 only**. Security fixes, regression fixes, and carefully capped dependency updates |
-| **8.2 / Java 21** | Active development (separate repo) | See [percussioncms](https://github.com/intersoftdatalabs-in/percussioncms) — not built from this tree |
+|   Version / line   |                Status                |                                                        Notes                                                        |
+|--------------------|--------------------------------------|---------------------------------------------------------------------------------------------------------------------|
+| **8.1.7**          | Current stable release on this repo  | Security hardening, WCAG-oriented accessibility work, Google Analytics 4, REST fixes, and ongoing 8.1.x maintenance |
+| **8.1.x (`main`)** | Active maintenance (this repository) | JDK **1.8 only**. Security fixes, regression fixes, and carefully capped dependency updates                         |
+| **8.2 / Java 21**  | Active development (separate repo)   | See [percussioncms](https://github.com/intersoftdatalabs-in/percussioncms) — not built from this tree               |
 
 **Stay on a current 8.1.x release** when you must remain on Java 8. Recent 8.1.x builds include important security patches.
 
@@ -89,11 +89,11 @@ Documentation: [percussioncmshelp.intsof.com](https://percussioncmshelp.intsof.c
 
 ### Requirements
 
-| Requirement | Notes |
-|-------------|--------|
-| **JDK 8** | Required. Amazon Corretto 8 or Eclipse Temurin 8 recommended. Set `JAVA_HOME` / `JAVA_HOME_8` to a **1.8** install only. |
-| **Git** | Including Git LFS (`git lfs pull` before building modules that use LFS) |
-| **Maven** | Prefer the repo wrapper + env scripts below (do not assume a system Maven on a newer JDK) |
+| Requirement |                                                          Notes                                                           |
+|-------------|--------------------------------------------------------------------------------------------------------------------------|
+| **JDK 8**   | Required. Amazon Corretto 8 or Eclipse Temurin 8 recommended. Set `JAVA_HOME` / `JAVA_HOME_8` to a **1.8** install only. |
+| **Git**     | Including Git LFS (`git lfs pull` before building modules that use LFS)                                                  |
+| **Maven**   | Prefer the repo wrapper + env scripts below (do not assume a system Maven on a newer JDK)                                |
 
 This line **must not** introduce language features, APIs, or dependencies that require Java 11+.
 
@@ -154,20 +154,20 @@ cd <installation-directory>\jetty\ && StartJetty.bat
 
 Default CMS URL: `http://localhost:9992/`
 
-Default Admin & Contributor users are generated with dynamically generated temporary passwords at startup.  These are written to <installation-directory>/var/config/generated/passwords.  These passwords should be changed and the password file deleted after post installation login. 
+Default Admin & Contributor users are generated with dynamically generated temporary passwords at startup.  These are written to <installation-directory>/var/config/generated/passwords.  These passwords should be changed and the password file deleted after post installation login.
 
 ---
 
 ## Key modules
 
-| Module | Path | Description |
-|--------|------|-------------|
-| CMS core | `system` | Server core |
-| WebUI | `WebUI` | Primary UI |
-| sitemanage | `projects/sitemanage` | Backend for the primary UI |
-| rest | `rest` | Public REST API |
-| DTS | `deliverytiersuite/delivery-tier-suite` | Delivery-tier services |
-| Distribution | `modules/perc-distribution-tree` | Installable CMS distribution |
+|    Module    |                  Path                   |         Description          |
+|--------------|-----------------------------------------|------------------------------|
+| CMS core     | `system`                                | Server core                  |
+| WebUI        | `WebUI`                                 | Primary UI                   |
+| sitemanage   | `projects/sitemanage`                   | Backend for the primary UI   |
+| rest         | `rest`                                  | Public REST API              |
+| DTS          | `deliverytiersuite/delivery-tier-suite` | Delivery-tier services       |
+| Distribution | `modules/perc-distribution-tree`        | Installable CMS distribution |
 
 ---
 
@@ -177,8 +177,8 @@ We welcome contributions that keep the **8.1.x / Java 8** line healthy: bug fixe
 
 Please see:
 
-- [CONTRIBUTING.md](CONTRIBUTING.md) — process and orientation  
-- [AGENTS.md](AGENTS.md) — coding, build, and PR conventions for this repo  
+- [CONTRIBUTING.md](CONTRIBUTING.md) — process and orientation
+- [AGENTS.md](AGENTS.md) — coding, build, and PR conventions for this repo
 
 **Do not** land Java 11+ only dependencies or language features on `main`.  
 For Java 21 / 8.2 work, open PRs against [percussioncms](https://github.com/intersoftdatalabs-in/percussioncms).
@@ -187,10 +187,10 @@ For Java 21 / 8.2 work, open PRs against [percussioncms](https://github.com/inte
 
 ## Related repositories
 
-| Repository | Role |
-|------------|------|
-| **[percussioncms-java8](https://github.com/intersoftdatalabs-in/percussioncms-java8)** (this repo) | Java 8 LTS — **8.1.x** maintenance |
-| **[percussioncms](https://github.com/intersoftdatalabs-in/percussioncms)** | Active product line — **Java 21 / 8.2** development |
+|                                             Repository                                             |                        Role                         |
+|----------------------------------------------------------------------------------------------------|-----------------------------------------------------|
+| **[percussioncms-java8](https://github.com/intersoftdatalabs-in/percussioncms-java8)** (this repo) | Java 8 LTS — **8.1.x** maintenance                  |
+| **[percussioncms](https://github.com/intersoftdatalabs-in/percussioncms)**                         | Active product line — **Java 21 / 8.2** development |
 
 ---
 

diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/README.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/README.md
@@ -7,15 +7,15 @@ not used — per user direction, the GH scan alerts themselves are the tracker).
 
 ## Files
 
-| File | Purpose |
-|---|---|
-| `alerts.md` | Raw open-alert dump (610 rows, 2026-08-09) |
-| `alerts-stale-cache.md` | Alerts whose source file is no longer in `git ls-files` (0 rows) |
-| `clusters.md` | Critical/High open grouped by `rule.id` (429 rows, 30 clusters) |
-| `triage.md` | One row per open Critical/High alert (empty; populated by tasks 2-8) |
-| `suppressions.md` | Inline `// codeql[...]` and path-level exclusion index |
-| `accepted-risks.md` | Sinks that cannot be closed without legacy removal or Java 9+ |
-| `codeql-pr-playbook.md` | Per-task workflow guide |
+|          File           |                               Purpose                                |
+|-------------------------|----------------------------------------------------------------------|
+| `alerts.md`             | Raw open-alert dump (610 rows, 2026-08-09)                           |
+| `alerts-stale-cache.md` | Alerts whose source file is no longer in `git ls-files` (0 rows)     |
+| `clusters.md`           | Critical/High open grouped by `rule.id` (429 rows, 30 clusters)      |
+| `triage.md`             | One row per open Critical/High alert (empty; populated by tasks 2-8) |
+| `suppressions.md`       | Inline `// codeql[...]` and path-level exclusion index               |
+| `accepted-risks.md`     | Sinks that cannot be closed without legacy removal or Java 9+        |
+| `codeql-pr-playbook.md` | Per-task workflow guide                                              |
 
 ## Pipeline
 

diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/accepted-risks.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/accepted-risks.md
@@ -6,8 +6,9 @@ with the 8.3 re-review window per the 004 spec C4 contract).
 
 Schema (per spec 004 C4):
 
-| alert_id | rule_id | severity | file_path:line | justification | re_review_by | linked_pr | notes |
-|----------|---------|----------|----------------|---------------|--------------|-----------|-------|
-| 502 | java/weak-cryptographic-algorithm | high | modules/perc-legacy/src/main/java/com/percussion/legacy/security/deprecated/PSAesCBC.java:65 | Deprecated class still wired as fallback decryption in 3 callers; AES/CBC/PKCS5Padding vulnerable to padding oracle; GCM migration requires re-encrypting stored credentials and updating PSAesCBC + callers to a SecretKey-derived PSAESGCMKey path. Re-review at 8.3 cut to confirm migration plan. | 2027-07-31 | TBD | Accept until legacy crypto migration |
-| 503 | java/weak-cryptographic-algorithm | high | modules/perc-legacy/src/main/java/com/percussion/legacy/security/deprecated/PSAesCBC.java:94 | Same deprecated class as #502; second Cipher.getInstance sink. | 2027-07-31 | TBD | Accept until legacy crypto migration |
-| 569 | java/static-initialization-vector | high | modules/perc-legacy/src/main/java/com/percussion/legacy/security/deprecated/PSAesCBC.java:99 | Hardcoded IV in deprecated class; static IV with CBC is a known weakness. Resolved by AES-GCM migration that prepends a random nonce (PSAESGCMEncryptor.encrypt already does this). | 2027-07-31 | TBD | Accept until legacy crypto migration |
+| alert_id |              rule_id              | severity |                                        file_path:line                                        |                                                                                                                                             justification                                                                                                                                             | re_review_by | linked_pr |                notes                 |
+|----------|-----------------------------------|----------|----------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|-----------|--------------------------------------|
+| 502      | java/weak-cryptographic-algorithm | high     | modules/perc-legacy/src/main/java/com/percussion/legacy/security/deprecated/PSAesCBC.java:65 | Deprecated class still wired as fallback decryption in 3 callers; AES/CBC/PKCS5Padding vulnerable to padding oracle; GCM migration requires re-encrypting stored credentials and updating PSAesCBC + callers to a SecretKey-derived PSAESGCMKey path. Re-review at 8.3 cut to confirm migration plan. | 2027-07-31   | TBD       | Accept until legacy crypto migration |
+| 503      | java/weak-cryptographic-algorithm | high     | modules/perc-legacy/src/main/java/com/percussion/legacy/security/deprecated/PSAesCBC.java:94 | Same deprecated class as #502; second Cipher.getInstance sink.                                                                                                                                                                                                                                        | 2027-07-31   | TBD       | Accept until legacy crypto migration |
+| 569      | java/static-initialization-vector | high     | modules/perc-legacy/src/main/java/com/percussion/legacy/security/deprecated/PSAesCBC.java:99 | Hardcoded IV in deprecated class; static IV with CBC is a known weakness. Resolved by AES-GCM migration that prepends a random nonce (PSAESGCMEncryptor.encrypt already does this).                                                                                                                   | 2027-07-31   | TBD       | Accept until legacy crypto migration |
+
diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts-stale-cache.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts-stale-cache.md
@@ -12,3 +12,4 @@ release readiness. See
 
 | alert_id | rule_id | path | last_seen_branch |
 |----------|---------|------|------------------|
+
diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md
@@ -10,71 +10,55 @@ Generated: (python port — timestamp not embedded; see file mtime)
   - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/718
   - **Location:** delivery/common/js/views/PercTagListView.js:123
   - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters.
-
-
 - **Alert #717** — `js/xss-through-dom` (high, CodeQL)
   - **Tool:** CodeQL
   - **State:** open
   - **Created:** 2026-08-15T22:36:30Z
   - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/717
   - **Location:** delivery/common/js/views/PercBlogPostView.js:162
   - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters.
-
-
 - **Alert #716** — `js/xss-through-dom` (high, CodeQL)
   - **Tool:** CodeQL
   - **State:** open
   - **Created:** 2026-08-15T22:36:30Z
   - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/716
   - **Location:** delivery/common/js/views/PercBlogPostView.js:152
   - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters.
-
-
 - **Alert #714** — `js/xss-through-dom` (high, CodeQL)
   - **Tool:** CodeQL
   - **State:** open
   - **Created:** 2026-08-15T20:29:35Z
   - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/714
   - **Location:** delivery/common/js/views/PercRegistrationView.js:272
   - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters.
-
-
 - **Alert #713** — `js/xss-through-dom` (high, CodeQL)
   - **Tool:** CodeQL
   - **State:** open
   - **Created:** 2026-08-15T20:29:35Z
   - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/713
   - **Location:** delivery/common/js/views/PercRegistrationView.js:83
   - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters.
-
-
 - **Alert #712** — `js/xss-through-dom` (high, CodeQL)
   - **Tool:** CodeQL
   - **State:** open
   - **Created:** 2026-08-15T20:29:35Z
   - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/712
   - **Location:** delivery/common/js/views/PercCategoryListView.js:199
   - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters.
-
-
 - **Alert #711** — `js/xss-through-dom` (high, CodeQL)
   - **Tool:** CodeQL
   - **State:** open
   - **Created:** 2026-08-15T20:29:35Z
   - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/711
   - **Location:** delivery/common/js/views/PercArchiveListView.js:288
   - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters.
-
-
 - **Alert #710** — `js/xss-through-dom` (high, CodeQL)
   - **Tool:** CodeQL
   - **State:** open
   - **Created:** 2026-08-15T20:29:35Z
   - **URL:** https://github.com/intersoftdatalabs-in/percussioncms-java8/security/code-scanning/710
   - **Location:** delivery/common/js/views/PercArchiveListView.js:199
   - **Message:** DOM text is reinterpreted as HTML without escaping meta-characters.
-
-
 - **Alert #709** — `js/xss-through-dom` (high, CodeQL)
   - **Tool:** CodeQL
   - **State:** open

diff --git a/docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md b/docs/ai-generated/tasks/8.1.x-codeql-baseline/clusters.md
@@ -11,9 +11,9 @@ Source: docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md
 
 ## Cluster Map
 
-| Rule | Severity | Count | Reference 004 PR | Notes |
-|---|---|---|---|---|
-| `js/xss-through-dom` | high | 9 | this PR | 8.1.x: code fix in this PR; inlined /^\s*(?:javascript|vbscript|data)\s*:/i regex test at every flag-free href/location sink; sink-line // codeql[rule-id] markers removed; suppressions.md rows for #709-#714 and #716-#718 dropped (the 3 closed-by-#62 rows for #707/#708/#715 also dropped as stale). Awaits next GHAS scan to dismiss. |
+|         Rule         | Severity | Count | Reference 004 PR |                         Notes                          |
+|----------------------|----------|-------|------------------|--------------------------------------------------------|----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `js/xss-through-dom` | high     | 9     | this PR          | 8.1.x: code fix in this PR; inlined /^\s*(?:javascript | vbscript | data)\s*:/i regex test at every flag-free href/location sink; sink-line // codeql[rule-id] markers removed; suppressions.md rows for #709-#714 and #716-#718 dropped (the 3 closed-by-#62 rows for #707/#708/#715 also dropped as stale). Awaits next GHAS scan to dismiss. |
 
 ## Per-Cluster Detail
 
@@ -28,3 +28,4 @@ Source: docs/ai-generated/tasks/8.1.x-codeql-baseline/alerts.md
 - Alert #711 — `delivery/common/js/views/PercArchiveListView.js:283`
 - Alert #710 — `delivery/common/js/views/PercArchiveListView.js:194`
 - Alert #709 — `delivery/common/js/views/PercArchiveListView.js:133`
+
Original file line number	Diff line number	Diff line change
Expand Up		@@ -12,3 +12,4 @@ release readiness. See

		\| alert_id \| rule_id \| path \| last_seen_branch \|
		\|----------\|---------\|------\|------------------\|