From dad6df1512b8c24758d6b70722a29b9762265ce9 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Fri, 18 Sep 2026 13:22:42 +0300
Subject: [PATCH 1/2] Fix query-filter escaping and HTML injection in UI filter
 editors

- policy.js "unique": the user-supplied value is now escaped with
  auth/queryFilter.escapeStringValue, so a backslash or quote in it can
  neither break the _queryFilter literal nor inject predicates
- BackgridUtils.queryFilter: escape backslashes before quotes
- UserQueryFilterEditor / LinkQualifierFilterEditor: build <option>
  elements through the DOM API instead of string concatenation; the
  UserQueryFilterEditor lookup also no longer prefixes an extra "/",
  which used to add a duplicate option for every known property
- PoliciesDialogView: set the default-action stars as text
- GenericEditResourceView: strip every escaping backslash from the
  selector, not only the first one
- ReconTypeBase: widen ignoreFields to int

Resolves CodeQL alerts #739-#743 (js/incomplete-sanitization),
#745-#748 (js/xss-through-dom) and #910
(java/implicit-cast-in-compound-assignment).
---
 .../openidm/sync/impl/ReconTypeBase.java      |  2 +-
 .../mapping/behaviors/PoliciesDialogView.js   |  9 +-
 .../mapping/util/LinkQualifierFilterEditor.js | 11 ++-
 .../admin/role/util/UserQueryFilterEditor.js  | 20 ++--
 .../openidm/ui/admin/util/BackgridUtils.js    |  4 +-
 .../util/LinkQualifierFilterEditorTest.js     | 57 ++++++++++-
 .../role/util/UserQueryFilterEditorTest.js    | 64 ++++++++++++-
 .../ui/admin/util/BackgridUtilsTest.js        | 40 +++++++-
 .../resource/GenericEditResourceView.js       |  7 +-
 .../resources/bin/defaults/script/policy.js   |  5 +-
 .../bin/defaults/script/policyUniqueTest.js   | 96 +++++++++++++++++++
 openidm-zip/src/test/resources/testRunner.js  |  1 +
 12 files changed, 291 insertions(+), 25 deletions(-)
 create mode 100644 openidm-zip/src/test/resources/bin/defaults/script/policyUniqueTest.js

diff --git a/openidm-core/src/main/java/org/forgerock/openidm/sync/impl/ReconTypeBase.java b/openidm-core/src/main/java/org/forgerock/openidm/sync/impl/ReconTypeBase.java
index 7146f73b00..bcdc8d390e 100644
--- a/openidm-core/src/main/java/org/forgerock/openidm/sync/impl/ReconTypeBase.java
+++ b/openidm-core/src/main/java/org/forgerock/openidm/sync/impl/ReconTypeBase.java
@@ -290,7 +290,7 @@ private boolean hasFullEntry(JsonValue entry, QuerySide querySide) {
         
         if (entry != null) {
 
-            short ignoreFields = 0;
+            int ignoreFields = 0;
             if (entry.isDefined("_id")) {
                 ignoreFields++;
             }
diff --git a/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/mapping/behaviors/PoliciesDialogView.js b/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/mapping/behaviors/PoliciesDialogView.js
index 0c583b2fba..dc8cbd7bad 100644
--- a/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/mapping/behaviors/PoliciesDialogView.js
+++ b/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/mapping/behaviors/PoliciesDialogView.js
@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2015-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 
 define([
@@ -47,8 +48,8 @@ define([
                 title = "";
 
             this.data = {
-                star: "&#9733;",
-                hollowStar: "&#9734;",
+                star: "★",
+                hollowStar: "☆",
                 situation: args.situation,
                 edit: args.edit,
                 defaultAction: false,
@@ -119,12 +120,12 @@ define([
                             // Set viable options stars
                             _.each(this.model.basePolicy.options, function(action) {
                                 tempSelector = $("#defaultActionPane select option[value='"+action+"']");
-                                tempSelector.html(tempSelector.text() + " " + this.data.hollowStar);
+                                tempSelector.text(tempSelector.text() + " " + this.data.hollowStar);
                             }, this);
 
                             // Set default option star
                             tempSelector = $("#defaultActionPane select option[value='"+this.model.basePolicy.action+"']");
-                            tempSelector.html(tempSelector.text() + " " + this.data.star);
+                            tempSelector.text(tempSelector.text() + " " + this.data.star);
 
                             this.$el.find("#defaultActionPane select").val(this.model.basePolicy.action);
 
diff --git a/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/mapping/util/LinkQualifierFilterEditor.js b/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/mapping/util/LinkQualifierFilterEditor.js
index 36d86a7b62..3ad93da0a9 100644
--- a/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/mapping/util/LinkQualifierFilterEditor.js
+++ b/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/mapping/util/LinkQualifierFilterEditor.js
@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2015-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 
 define([
@@ -152,9 +153,11 @@ define([
                 tempValue,
                 displayValue;
 
+            // Options are built through the DOM API, never by string concatenation: the names come
+            // from the stored condition and must be treated as text, not markup.
             _.each(this.model.sourceProps, function(source) {
                 if(source !== undefined) {
-                    baseElement.append('<option value="/object/' +source +'">' +source +'</option>');
+                    baseElement.append($("<option>").attr("value", "/object/" + source).text(source));
                 }
             });
 
@@ -162,10 +165,12 @@ define([
                 tempValue = $(this).val();
                 appendElement = baseElement.clone();
 
-                if(tempValue.length > 0 && appendElement.find("option[value='/object/" +tempValue  +"']").length === 0 && appendElement.find("option[value='" +tempValue  +"']").length === 0) {
+                if(tempValue.length > 0 && appendElement.find("option").filter(function() {
+                    return this.value === tempValue || this.value === "/object/" + tempValue;
+                }).length === 0) {
                     displayValue = tempValue.replace("/object/", "");
 
-                    appendElement.append('<option value="' +tempValue +'">' +displayValue +'</option>');
+                    appendElement.append($("<option>").attr("value", tempValue).text(displayValue));
                 }
 
                 $(this).replaceWith(appendElement);
diff --git a/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/role/util/UserQueryFilterEditor.js b/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/role/util/UserQueryFilterEditor.js
index 23ad328893..e11a40b09a 100644
--- a/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/role/util/UserQueryFilterEditor.js
+++ b/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/role/util/UserQueryFilterEditor.js
@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 
 define([
@@ -133,21 +134,26 @@ define([
         createNameDropdown: function(input) {
             var baseElement = $('<select style="width:100%;" class="name form-control"></select>'),
                 tempValue = $(input).val(),
-                displayValue;
+                pointer;
 
+            // Options are built through the DOM API, never by string concatenation: the names come
+            // from the stored condition and must be treated as text, not markup.
             _.each(this.model.sourceProps, function(source) {
                 if(source !== undefined) {
-                    baseElement.append('<option value="/' +source +'">' +source +'</option>');
+                    baseElement.append($("<option>").attr("value", "/" + source).text(source));
                 }
             });
 
-            if(tempValue.length > 0 && baseElement.find("option[value='/" +tempValue  +"']").length === 0 && baseElement.find("option[value='/" +tempValue  +"']").length === 0) {
-                displayValue = tempValue.replace("/", "");
+            if(tempValue.length > 0) {
+                // the stored name is a JSON pointer ("/mail"); tolerate a bare property name too
+                pointer = tempValue.charAt(0) === "/" ? tempValue : "/" + tempValue;
 
-                baseElement.append('<option value="/' +tempValue +'">' +displayValue +'</option>');
-            }
+                if(baseElement.find("option").filter(function() { return this.value === pointer; }).length === 0) {
+                    baseElement.append($("<option>").attr("value", pointer).text(pointer.substring(1)));
+                }
 
-            baseElement.val(tempValue);
+                baseElement.val(pointer);
+            }
 
             return baseElement;
         }
diff --git a/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/util/BackgridUtils.js b/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/util/BackgridUtils.js
index 33593e1bd8..3c566b10eb 100644
--- a/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/util/BackgridUtils.js
+++ b/openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/util/BackgridUtils.js
@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 
 define([
@@ -29,7 +30,8 @@ define([
             additionalFilters = data._queryFilter || [],
             getFilter = (function () {
                 return function (filterName, filterQuery) {
-                    return filterName + ' sw "' + filterQuery.replace(/"/g, '\\"') + '"';
+                    // backslash first, so a value ending in a backslash cannot escape the closing quote
+                    return filterName + ' sw "' + filterQuery.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + '"';
                 };
             }());
 
diff --git a/openidm-ui/openidm-ui-admin/src/test/qunit/org/forgerock/openidm/ui/admin/mapping/util/LinkQualifierFilterEditorTest.js b/openidm-ui/openidm-ui-admin/src/test/qunit/org/forgerock/openidm/ui/admin/mapping/util/LinkQualifierFilterEditorTest.js
index 831b1a46f5..b43a3926d7 100644
--- a/openidm-ui/openidm-ui-admin/src/test/qunit/org/forgerock/openidm/ui/admin/mapping/util/LinkQualifierFilterEditorTest.js
+++ b/openidm-ui/openidm-ui-admin/src/test/qunit/org/forgerock/openidm/ui/admin/mapping/util/LinkQualifierFilterEditorTest.js
@@ -1,5 +1,58 @@
+/**
+ * The contents of this file are subject to the terms of the Common Development and
+ * Distribution License (the License). You may not use this file except in compliance with the
+ * License.
+ *
+ * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+ * specific language governing permission and limitations under the License.
+ *
+ * When distributing Covered Software, include this CDDL Header Notice in each file and include
+ * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+ * Header, with the fields enclosed by brackets [] replaced by your own identifying
+ * information: "Portions copyright [year] [name of copyright owner]".
+ *
+ * Copyright 2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
+ */
+
 define([
+    "jquery",
     "org/forgerock/openidm/ui/admin/mapping/util/LinkQualifierFilterEditor"
-], function (LinkQualifierFilterEditor) {
+], function ($, LinkQualifierFilterEditor) {
     QUnit.module('LinkQualifierFilterEditor Tests');
-});
\ No newline at end of file
+
+    QUnit.test("createNameDropdown treats an unknown property name as text, not HTML", function (assert) {
+        var editor = new LinkQualifierFilterEditor(),
+            hostile = '/object/x"><b>y</b>',
+            select;
+
+        editor.model = { sourceProps: ["userName"] };
+        editor.$el = $('<div><input class="name"></div>');
+        editor.$el.find(".name").val(hostile);
+
+        editor.createNameDropdown();
+        select = editor.$el.find("select.name");
+
+        assert.equal(select.length, 1, "the input is replaced by a select");
+        assert.equal(select.find("option").length, 3, "Link Qualifier + source prop + exactly one option for the unknown value");
+        assert.equal(select.find("b").length, 0, "no element is created from the value");
+        assert.equal(select.find("option").last().attr("value"), hostile, "option value is the raw text");
+        assert.equal(select.find("option").last().text(), 'x"><b>y</b>', "option label is the raw text without the /object/ prefix");
+        assert.equal(select.val(), hostile, "the unknown value is selected");
+    });
+
+    QUnit.test("createNameDropdown selects a known property without adding a duplicate option", function (assert) {
+        var editor = new LinkQualifierFilterEditor(),
+            select;
+
+        editor.model = { sourceProps: ["userName", "mail"] };
+        editor.$el = $('<div><input class="name"></div>');
+        editor.$el.find(".name").val("/object/mail");
+
+        editor.createNameDropdown();
+        select = editor.$el.find("select.name");
+
+        assert.equal(select.find("option").length, 3, "Link Qualifier + two source props, no extra option");
+        assert.equal(select.val(), "/object/mail");
+    });
+});
diff --git a/openidm-ui/openidm-ui-admin/src/test/qunit/org/forgerock/openidm/ui/admin/role/util/UserQueryFilterEditorTest.js b/openidm-ui/openidm-ui-admin/src/test/qunit/org/forgerock/openidm/ui/admin/role/util/UserQueryFilterEditorTest.js
index 6520a4ebca..cc36053f13 100644
--- a/openidm-ui/openidm-ui-admin/src/test/qunit/org/forgerock/openidm/ui/admin/role/util/UserQueryFilterEditorTest.js
+++ b/openidm-ui/openidm-ui-admin/src/test/qunit/org/forgerock/openidm/ui/admin/role/util/UserQueryFilterEditorTest.js
@@ -1,5 +1,65 @@
+/**
+ * The contents of this file are subject to the terms of the Common Development and
+ * Distribution License (the License). You may not use this file except in compliance with the
+ * License.
+ *
+ * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+ * specific language governing permission and limitations under the License.
+ *
+ * When distributing Covered Software, include this CDDL Header Notice in each file and include
+ * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+ * Header, with the fields enclosed by brackets [] replaced by your own identifying
+ * information: "Portions copyright [year] [name of copyright owner]".
+ *
+ * Copyright 2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
+ */
+
 define([
+    "jquery",
     "org/forgerock/openidm/ui/admin/role/util/UserQueryFilterEditor"
-], function (UserQueryFilterEditor) {
+], function ($, UserQueryFilterEditor) {
     QUnit.module('UserQueryFilterEditor Tests');
-});
\ No newline at end of file
+
+    QUnit.test("createNameDropdown treats an unknown property name as text, not HTML", function (assert) {
+        var editor = new UserQueryFilterEditor(),
+            hostile = 'x"><b>y</b>',
+            select;
+
+        editor.model = { sourceProps: ["userName"] };
+
+        select = editor.createNameDropdown($("<input>").val(hostile));
+
+        assert.equal(select.find("option").length, 2, "exactly one option is added for the unknown value");
+        assert.equal(select.find("b").length, 0, "no element is created from the value");
+        assert.equal(select.find("option").last().attr("value"), "/" + hostile, "option value is the raw text");
+        assert.equal(select.find("option").last().text(), hostile, "option label is the raw text");
+        assert.equal(select.val(), "/" + hostile, "the unknown value is selected");
+    });
+
+    QUnit.test("createNameDropdown keeps an unknown JSON-pointer name as-is and labels it without the slash", function (assert) {
+        var editor = new UserQueryFilterEditor(),
+            select;
+
+        editor.model = { sourceProps: ["userName"] };
+
+        select = editor.createNameDropdown($("<input>").val("/custom"));
+
+        assert.equal(select.find("option").length, 2);
+        assert.equal(select.find("option").last().attr("value"), "/custom");
+        assert.equal(select.find("option").last().text(), "custom");
+        assert.equal(select.val(), "/custom");
+    });
+
+    QUnit.test("createNameDropdown selects a known property without adding a duplicate option", function (assert) {
+        var editor = new UserQueryFilterEditor(),
+            select;
+
+        editor.model = { sourceProps: ["userName", "mail"] };
+
+        select = editor.createNameDropdown($("<input>").val("/mail"));
+
+        assert.equal(select.find("option").length, 2, "no extra option is added");
+        assert.equal(select.val(), "/mail");
+    });
+});
diff --git a/openidm-ui/openidm-ui-admin/src/test/qunit/org/forgerock/openidm/ui/admin/util/BackgridUtilsTest.js b/openidm-ui/openidm-ui-admin/src/test/qunit/org/forgerock/openidm/ui/admin/util/BackgridUtilsTest.js
index 063fef8765..0c56285c3f 100644
--- a/openidm-ui/openidm-ui-admin/src/test/qunit/org/forgerock/openidm/ui/admin/util/BackgridUtilsTest.js
+++ b/openidm-ui/openidm-ui-admin/src/test/qunit/org/forgerock/openidm/ui/admin/util/BackgridUtilsTest.js
@@ -1,5 +1,43 @@
+/**
+ * The contents of this file are subject to the terms of the Common Development and
+ * Distribution License (the License). You may not use this file except in compliance with the
+ * License.
+ *
+ * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+ * specific language governing permission and limitations under the License.
+ *
+ * When distributing Covered Software, include this CDDL Header Notice in each file and include
+ * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+ * Header, with the fields enclosed by brackets [] replaced by your own identifying
+ * information: "Portions copyright [year] [name of copyright owner]".
+ *
+ * Copyright 2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
+ */
+
 define([
     "org/forgerock/openidm/ui/admin/util/BackgridUtils"
 ], function (BackgridUtils) {
     QUnit.module('BackgridUtils Tests');
-});
\ No newline at end of file
+
+    function queryFilterFor(text) {
+        var gridState = {
+            state: {
+                filters: [{ name: "userName", query: function () { return text; } }]
+            }
+        };
+        return BackgridUtils.queryFilter.call(gridState, {});
+    }
+
+    QUnit.test("queryFilter escapes a double quote in the filter text", function (assert) {
+        assert.equal(queryFilterFor('a"b'), 'userName sw "a\\"b"');
+    });
+
+    QUnit.test("queryFilter escapes a backslash so it cannot swallow the closing quote", function (assert) {
+        assert.equal(queryFilterFor('a\\'), 'userName sw "a\\\\"');
+    });
+
+    QUnit.test("queryFilter escapes a backslash-quote sequence so it cannot break out of the literal", function (assert) {
+        assert.equal(queryFilterFor('a\\"b'), 'userName sw "a\\\\\\"b"');
+    });
+});
diff --git a/openidm-ui/openidm-ui-common/src/main/js/org/forgerock/openidm/ui/common/resource/GenericEditResourceView.js b/openidm-ui/openidm-ui-common/src/main/js/org/forgerock/openidm/ui/common/resource/GenericEditResourceView.js
index a4a96bb244..d6c0bb656a 100644
--- a/openidm-ui/openidm-ui-common/src/main/js/org/forgerock/openidm/ui/common/resource/GenericEditResourceView.js
+++ b/openidm-ui/openidm-ui-common/src/main/js/org/forgerock/openidm/ui/common/resource/GenericEditResourceView.js
@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 
 define([
@@ -549,7 +550,7 @@ define([
                         propertyValue: el.val(),
                         schema: _this.data.schema,
                         onChange: function (value, originalPropertyValue, newText) {
-                            _this.editor.getEditor("root" + prop.selector.replace("\\","")).setValue(JSON.stringify(value));
+                            _this.editor.getEditor("root" + prop.selector.replace(/\\/g, "")).setValue(JSON.stringify(value));
                             relationshipDisplay.remove();
                             convertField(prop);
                             _this.$el.find("#resourceEditLink-" + prop.propName).text(newText);
@@ -562,7 +563,7 @@ define([
                     }
                     if ($(e.target).attr("id") === removeButtonId || $(e.target).closest(".removeRelationshipButton").attr("id") === removeButtonId) {
                         e.preventDefault();
-                        _this.editor.getEditor("root" + prop.selector.replace("\\","")).setValue("null");
+                        _this.editor.getEditor("root" + prop.selector.replace(/\\/g, "")).setValue("null");
                         relationshipDisplay.remove();
                         convertField(prop);
                         //_this.$el.find("#resourceEditLink-" + prop.propName).text("");
@@ -580,7 +581,7 @@ define([
 
             convertArrayField = function(prop) {
                 var doConversion = function (tabView) {
-                    _this.editor.getEditor('root' + prop.selector.replace("\\","")).destroy();
+                    _this.editor.getEditor('root' + prop.selector.replace(/\\/g, "")).destroy();
 
                     //in case this relationship array field is returned by default
                     //remove it from the original version of the resource
diff --git a/openidm-zip/src/main/resources/bin/defaults/script/policy.js b/openidm-zip/src/main/resources/bin/defaults/script/policy.js
index a26cdab6d1..848f39c1da 100644
--- a/openidm-zip/src/main/resources/bin/defaults/script/policy.js
+++ b/openidm-zip/src/main/resources/bin/defaults/script/policy.js
@@ -20,6 +20,8 @@
  * with the fields enclosed by brackets [] replaced by
  * your own identifying information:
  * "Portions Copyrighted [year] [name of copyright owner]"
+ *
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 
 /*global additionalPolicies,resources, require */
@@ -241,8 +243,9 @@ policyImpl = (function (){
     policyFunctions.unique = function(fullObject, value, params, property) {
         var queryParams,existing,requestId,requestBaseArray;
         if (value && value.length) {
+            // value is user-supplied: escape it so it cannot break out of the query filter string
             queryParams = {
-                "_queryFilter": property + ' eq "' + value.replace(/"/g, '\\"') + '"'
+                "_queryFilter": property + ' eq "' + require('auth/queryFilter').escapeStringValue(value) + '"'
             };
 
             requestId = resourceName.leaf();
diff --git a/openidm-zip/src/test/resources/bin/defaults/script/policyUniqueTest.js b/openidm-zip/src/test/resources/bin/defaults/script/policyUniqueTest.js
new file mode 100644
index 0000000000..001c5d660d
--- /dev/null
+++ b/openidm-zip/src/test/resources/bin/defaults/script/policyUniqueTest.js
@@ -0,0 +1,96 @@
+/*
+ * The contents of this file are subject to the terms of the Common Development and
+ * Distribution License (the License). You may not use this file except in compliance with the
+ * License.
+ *
+ * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+ * specific language governing permission and limitations under the License.
+ *
+ * When distributing Covered Software, include this CDDL Header Notice in each file and include
+ * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+ * Header, with the fields enclosed by brackets [] replaced by your own identifying
+ * information: "Portions copyright [year] [name of copyright owner]".
+ *
+ * Copyright 2026 3A Systems, LLC.
+ */
+
+/*global require, exports, java */
+
+/**
+ * Tests the "unique" policy of policy.js.
+ *
+ * The value under validation is user-supplied (it arrives with the create/update request, including
+ * self-registration) and is embedded in a CREST query filter string literal. It must be escaped the
+ * same way auth/queryFilter.escapeStringValue does, so that neither a backslash nor a double quote
+ * can break the literal or inject further predicates.
+ *
+ * policy.js is not a module: it is a script that expects the OpenIDM host globals (request,
+ * resources, resourceName, openidm) and ends by running the request. The test therefore reads
+ * the real script from the classpath and evaluates it inside a function that provides those
+ * globals as stubs, capturing the _queryFilter handed to openidm.query.
+ */
+exports.test = function () {
+    var queryFilter = require("auth/queryFilter"),
+        source = readClasspathResource("bin/defaults/script/policy.js");
+
+    [
+        ["plain", "plain value"],
+        ['a"b', "double quote"],
+        ["a\\", "trailing backslash must not swallow the closing quote"],
+        ['x\\" or /userName pr or /x eq "', "backslash-quote sequence must not break out of the literal"]
+    ].forEach(function (testcase) {
+        var value = testcase[0],
+            scenario = testcase[1],
+            captured = runUniquePolicy(source, value),
+            expected = 'userName eq "' + queryFilter.escapeStringValue(value) + '"';
+
+        if (captured !== expected) {
+            throw {
+                "message": "unique policy, " + scenario + ": got <" + captured + ">, expected <" + expected + ">"
+            };
+        }
+    });
+
+    function runUniquePolicy(source, value) {
+        var captured = null,
+            // ---- host globals policy.js expects; locals here so eval() resolves them ----
+            request = {
+                method: "action",
+                action: "validateProperty",
+                resourcePath: "managed/user/abc",
+                content: { userName: value }
+            },
+            resources = [{
+                resource: "managed/user/*",
+                properties: [{ name: "userName", policies: [{ policyId: "unique" }] }]
+            }],
+            resourceName = {
+                leaf: function () { return "abc"; },
+                parent: function () { return { toString: function () { return "managed/user"; } }; }
+            },
+            openidm = {
+                read: function () { return { objects: [] }; },
+                isEncrypted: function () { return false; },
+                query: function (resource, params) {
+                    captured = String(params._queryFilter);
+                    return { result: [] };
+                }
+            };
+
+        eval(source);
+        return captured;
+    }
+
+    function readClasspathResource(path) {
+        var url = java.lang.Thread.currentThread().getContextClassLoader().getResource(path),
+            scanner,
+            text;
+        if (url === null) {
+            throw { "message": "classpath resource not found: " + path };
+        }
+        scanner = new java.util.Scanner(url.openStream(), "UTF-8").useDelimiter("\\A");
+        text = scanner.hasNext() ? scanner.next() : "";
+        scanner.close();
+        return String(text);
+    }
+};
diff --git a/openidm-zip/src/test/resources/testRunner.js b/openidm-zip/src/test/resources/testRunner.js
index de369fc496..ef62de2216 100644
--- a/openidm-zip/src/test/resources/testRunner.js
+++ b/openidm-zip/src/test/resources/testRunner.js
@@ -20,6 +20,7 @@
  * exports a "test" method, and add it to the array of test modules below.
  */
 [ "policyFilterTest",
+  "policyUniqueTest",
   "queryFilterTest",
   "effectiveRolesTest",
   "temporalConstraintsTest",

From b86d8a738f5ddf0585d12371f43b9d24469d90d9 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Fri, 18 Sep 2026 16:23:04 +0300
Subject: [PATCH 2/2] Fix the remaining CodeQL warnings in policy.js

- validNameFormat: drop the code points listed twice in the character class
- cannotContainDuplicates: declare the loop index
- policyProcessor: a missing comma ended the module's var list early, so
  validate, mergePolicies, getAdditionalPolicies, updateResourceConfig
  and processRequest leaked into the global scope
- drop the dead assignments of validate()'s (undefined) result

Resolves CodeQL alerts #768-#770, #782, #783, #895, #896.
---
 .../main/resources/bin/defaults/script/policy.js   | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/openidm-zip/src/main/resources/bin/defaults/script/policy.js b/openidm-zip/src/main/resources/bin/defaults/script/policy.js
index 848f39c1da..8573651d2c 100644
--- a/openidm-zip/src/main/resources/bin/defaults/script/policy.js
+++ b/openidm-zip/src/main/resources/bin/defaults/script/policy.js
@@ -311,7 +311,7 @@ policyImpl = (function (){
     };
 
     policyFunctions.validNameFormat = function(fullObject, value, params, property) {
-        var pattern = /^([A-Za'-\u0105\u0107\u0119\u0142\u00F3\u015B\u017C\u017A\u0104\u0106\u0118\u0141\u00D3\u015A\u017B\u0179\u00C0\u00C8\u00CC\u00D2\u00D9\u00E0\u00E8\u00EC\u00F2\u00F9\u00C1\u00C9\u00CD\u00D3\u00DA\u00DD\u00E1\u00E9\u00ED\u00F3\u00FA\u00FD\u00C2\u00CA\u00CE\u00D4\u00DB\u00E2\u00EA\u00EE\u00F4\u00FB\u00C3\u00D1\u00D5\u00E3\u00F1\u00F5\u00C4\u00CB\u00CF\u00D6\u00DC\u0178\u00E4\u00EB\u00EF\u00F6\u00FC\u0178\u00A1\u00BF\u00E7\u00C7\u0152\u0153\u00DF\u00D8\u00F8\u00C5\u00E5\u00C6\u00E6\u00DE\u00FE\u00D0\u00F0\-\s])+$/,
+        var pattern = /^([A-Za'-\u0105\u0107\u0119\u0142\u00F3\u015B\u017C\u017A\u0104\u0106\u0118\u0141\u00D3\u015A\u017B\u0179\u00C0\u00C8\u00CC\u00D2\u00D9\u00E0\u00E8\u00EC\u00F2\u00F9\u00C1\u00C9\u00CD\u00DA\u00DD\u00E1\u00E9\u00ED\u00FA\u00FD\u00C2\u00CA\u00CE\u00D4\u00DB\u00E2\u00EA\u00EE\u00F4\u00FB\u00C3\u00D1\u00D5\u00E3\u00F1\u00F5\u00C4\u00CB\u00CF\u00D6\u00DC\u0178\u00E4\u00EB\u00EF\u00F6\u00FC\u00A1\u00BF\u00E7\u00C7\u0152\u0153\u00DF\u00D8\u00F8\u00C5\u00E5\u00C6\u00E6\u00DE\u00FE\u00D0\u00F0\-\s])+$/,
             isRequired = _.find(this.failedPolicyRequirements, function (fpr) {
                 return fpr.policyRequirement === "REQUIRED";
             }),
@@ -430,7 +430,8 @@ policyImpl = (function (){
     };
 
     policyFunctions.cannotContainDuplicates = function(fullObject, value, params, property) {
-        var checkedValues = {};
+        var checkedValues = {},
+            i;
         if (value && value.length) {
             for (i = 0; i < value.length; i++) {
                 if (Object.prototype.hasOwnProperty.call(checkedValues, value[i])) {
@@ -600,8 +601,8 @@ policyProcessor = (function (policyConfig,policyImpl){
                policies.push(fallbackPolicies[p]);
             }
         }
-        return policies
-    }
+        return policies;
+    },
 
     validate = function(policies, conditionalPolicies, fallbackPolicies, fullObject, propName, propValue, retArray) {
         var retObj = {},
@@ -847,7 +848,6 @@ policyProcessor = (function (policyConfig,policyImpl){
             fullObject,
             propName,
             policies,
-            policyRequirements,
             props,
             prop,
             conditionalPolicies,
@@ -897,7 +897,7 @@ policyProcessor = (function (policyConfig,policyImpl){
                         conditionalPolicies = resource.properties[i].conditionalPolicies;
                         fallbackPolicies = resource.properties[i].fallbackPolicies;
                         // Validate
-                        policyRequirements = validate(policies, conditionalPolicies, fallbackPolicies, fullObject,
+                        validate(policies, conditionalPolicies, fallbackPolicies, fullObject,
                                 propName, getPropertyValue(fullObject, propName), failedPolicyRequirements);
                     }
                 } else if (action === "validateProperty") {
@@ -909,7 +909,7 @@ policyProcessor = (function (policyConfig,policyImpl){
                             conditionalPolicies = prop.conditionalPolicies;
                             fallbackPolicies = prop.fallbackPolicies;
                             // Validate
-                            policyRequirements = validate(policies, conditionalPolicies, fallbackPolicies, fullObject,
+                            validate(policies, conditionalPolicies, fallbackPolicies, fullObject,
                                     propName, props[propName], failedPolicyRequirements);
                         }
                     }