fix: resolve the open CodeQL alerts

Strip HTML tags and XML comments until the text no longer changes, so that
nested input cannot reassemble a tag or comment after a single pass
(js/incomplete-multi-character-sanitization in website/.eleventy.js and
website/scripts/validate-version-info.js).

Limit the GITHUB_TOKEN of the PR compile check and the test version-XML
workflow to read access (actions/missing-workflow-permissions).

Claude-Session: https://claude.ai/code/session_01FJBfPYm6rCH4zD6T7bcC7Y

.github/workflows/nightly-artifacts.yml

@@ -32,6 +32,9 @@ jobs:
   test:
     name: Test (Java 21, headless)
     runs-on: ubuntu-latest
+    # A healthy run takes about four minutes. The per-test limit in build.gradle.kts names
+    # a hanging test; this cap covers a hang outside any test, such as in Gradle itself.
+    timeout-minutes: 20
 
     steps:
       - name: Checkout
@@ -108,8 +111,10 @@ jobs:
             exit 1
           fi
 
+      # Also on cancelled(): the job timeout cancels a hanging run, and the reports of the
+      # classes that did finish carry the timed-out tests' full stacks.
       - name: Keep the test reports on a failure
-        if: failure()
+        if: failure() || cancelled()
         uses: actions/upload-artifact@v7
         with:
           name: test-results

.github/workflows/pr-compile-check.yml

@@ -6,6 +6,9 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
@@ -155,6 +158,9 @@ jobs:
   test:
     name: Test (Java 21, headless)
     runs-on: ubuntu-latest
+    # A healthy run takes about four minutes. The per-test limit in build.gradle.kts names
+    # a hanging test; this cap covers a hang outside any test, such as in Gradle itself.
+    timeout-minutes: 20
 
     steps:
       - name: Checkout
@@ -283,8 +289,10 @@ jobs:
           if-no-files-found: ignore
           retention-days: 14
 
+      # Also on cancelled(): the job timeout cancels a hanging run, and the reports of the
+      # classes that did finish carry the timed-out tests' full stacks.
       - name: Keep the test reports on a failure
-        if: failure()
+        if: failure() || cancelled()
         uses: actions/upload-artifact@v7
         with:
           name: test-results

.github/workflows/tagged-release.yml

@@ -24,6 +24,9 @@ jobs:
   test:
     name: Test (Java 21, headless)
     runs-on: ubuntu-latest
+    # A healthy run takes about four minutes. The per-test limit in build.gradle.kts names
+    # a hanging test; this cap covers a hang outside any test, such as in Gradle itself.
+    timeout-minutes: 20
 
     steps:
       - name: Checkout
@@ -127,8 +130,10 @@ jobs:
             exit 1
           fi
 
+      # Also on cancelled(): the job timeout cancels a hanging run, and the reports of the
+      # classes that did finish carry the timed-out tests' full stacks.
       - name: Keep the test reports on a failure
-        if: failure()
+        if: failure() || cancelled()
         uses: actions/upload-artifact@v7
         with:
           name: test-results

.github/workflows/test-publish-version-xml.yml

@@ -3,6 +3,10 @@ name: TEST publish-version-xml (local only)
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+  issues: read
+
 jobs:
   publish-version-xml:
     name: Publish Version Info XML via WebDAV

build.gradle.kts

@@ -141,6 +141,21 @@ subprojects {
             }
             testUserHome.mkdirs()
         }
+        /*
+         * A test that never returns must fail by name instead of holding the job until
+         * GitHub kills it after six hours: Nightly #302 hung in :app-desktop:test for over
+         * an hour, and the log named only the task. The limit is far above the slowest test
+         * (under four seconds). SEPARATE_THREAD also ends a test whose thread ignores
+         * interruption, such as a busy loop or a blocked native call, and the failure's
+         * cause carries that thread's stack, so it shows where the test stood.
+         */
+        systemProperty("junit.jupiter.execution.timeout.default", "2m")
+        systemProperty("junit.jupiter.execution.timeout.thread.mode.default", "SEPARATE_THREAD")
+        // The default short format prints only the first frame of each cause, which for a
+        // timed-out test is the line it hung in but not the call that blocked there.
+        testLogging {
+            exceptionFormat = org.gradle.api.tasks.testing.logging.TestExceptionFormat.FULL
+        }
         finalizedBy(checkTestUserHome)
     }
 

packaging/aur/kst4contest-git/PKGBUILD

@@ -7,12 +7,22 @@ arch=('x86_64')
 url="https://github.com/HamRadioOnline/kst4contest"
 license=('GPL-3.0-only')
 depends=('gst-plugins-base' 'gst-plugins-good')
-makedepends=('java-environment=21' 'git')
+makedepends=('git')
 provides=('kst4contest')
 conflicts=('kst4contest' 'kst4contest-bin')
 source=("kst4contest::git+https://github.com/HamRadioOnline/kst4contest.git")
 sha256sums=('SKIP')
 
+# The launcher is built with Temurin, not with the system JDK. Arch's openjdk links
+# jpackage's launcher library against the shared libstdc++, and that build aborts
+# with "pure virtual method called" (SIGABRT, core dump) in a static destructor when
+# the application exits; Temurin links libstdc++ statically, like the CI packages.
+# The _x86_64 arrays are deliberate: aur-publish.yml rewrites the plain sha256sums=
+# line on every release and would drop a second entry there.
+_temurin=21.0.13+9
+source_x86_64=("https://github.com/adoptium/temurin21-binaries/releases/download/jdk-${_temurin/+/%2B}/OpenJDK21U-jdk_x64_linux_hotspot_${_temurin/+/_}.tar.gz")
+sha256sums_x86_64=('d7f5d5cf865a2902b70ff549b97586a7d3f234e016f041ab447ea740c7d66d1c')
+
 pkgver() {
     cd "${srcdir}/kst4contest"
     BASE=$(grep -m1 '^version=' gradle.properties \
@@ -23,7 +33,7 @@ pkgver() {
 build() {
     cd "${srcdir}/kst4contest"
 
-    export JAVA_HOME=$(find /usr/lib/jvm -maxdepth 1 -name 'java-21-*' -type d | head -n 1)
+    export JAVA_HOME="${srcdir}/jdk-${_temurin}"
     export PATH="${JAVA_HOME}/bin:${PATH}"
 
     # A Gradle home inside $srcdir keeps the build independent of whatever the
@@ -31,7 +41,13 @@ build() {
     # cache, every dependency added since the last local build broke the package.
     export GRADLE_USER_HOME="${srcdir}/gradle-home"
 
-    ./gradlew --no-daemon -S :app-desktop:createDistributable
+    # The Java toolchain, and with it jpackage, would otherwise pick any JDK 21 it
+    # finds in /usr/lib/jvm, the system one included.
+    ./gradlew --no-daemon -S \
+        -Porg.gradle.java.installations.auto-detect=false \
+        -Porg.gradle.java.installations.auto-download=false \
+        -Porg.gradle.java.installations.paths="${JAVA_HOME}" \
+        :app-desktop:createDistributable
 
     # package() reads dist/KST4Contest. Application name, icon and the JDK
     # module list come from app-desktop/build.gradle.kts.

packaging/aur/kst4contest/PKGBUILD

@@ -7,16 +7,25 @@ arch=('x86_64')
 url="https://github.com/HamRadioOnline/kst4contest"
 license=('GPL-3.0-only')
 depends=('gst-plugins-base' 'gst-plugins-good')
-makedepends=('java-environment=21')
 provides=('kst4contest')
 conflicts=('kst4contest-bin' 'kst4contest-git')
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/HamRadioOnline/kst4contest/archive/refs/tags/v${pkgver}.tar.gz")
 sha256sums=('e702df24a29e6f914a43934df0095bc4adbd00a9f02df3a632816c832272e914')
 
+# The launcher is built with Temurin, not with the system JDK. Arch's openjdk links
+# jpackage's launcher library against the shared libstdc++, and that build aborts
+# with "pure virtual method called" (SIGABRT, core dump) in a static destructor when
+# the application exits; Temurin links libstdc++ statically, like the CI packages.
+# The _x86_64 arrays are deliberate: aur-publish.yml rewrites the plain sha256sums=
+# line on every release and would drop a second entry there.
+_temurin=21.0.13+9
+source_x86_64=("https://github.com/adoptium/temurin21-binaries/releases/download/jdk-${_temurin/+/%2B}/OpenJDK21U-jdk_x64_linux_hotspot_${_temurin/+/_}.tar.gz")
+sha256sums_x86_64=('d7f5d5cf865a2902b70ff549b97586a7d3f234e016f041ab447ea740c7d66d1c')
+
 build() {
     cd "${srcdir}/kst4contest-${pkgver}"
 
-    export JAVA_HOME=$(find /usr/lib/jvm -maxdepth 1 -name 'java-21-*' -type d | head -n 1)
+    export JAVA_HOME="${srcdir}/jdk-${_temurin}"
     export PATH="${JAVA_HOME}/bin:${PATH}"
 
     # A Gradle home inside $srcdir keeps the build independent of whatever the
@@ -24,7 +33,13 @@ build() {
     # cache, every dependency added since the last local build broke the package.
     export GRADLE_USER_HOME="${srcdir}/gradle-home"
 
-    ./gradlew --no-daemon -S :app-desktop:createDistributable
+    # The Java toolchain, and with it jpackage, would otherwise pick any JDK 21 it
+    # finds in /usr/lib/jvm, the system one included.
+    ./gradlew --no-daemon -S \
+        -Porg.gradle.java.installations.auto-detect=false \
+        -Porg.gradle.java.installations.auto-download=false \
+        -Porg.gradle.java.installations.paths="${JAVA_HOME}" \
+        :app-desktop:createDistributable
 
     # package() reads dist/KST4Contest. Application name, icon and the JDK
     # module list come from app-desktop/build.gradle.kts, so this PKGBUILD no

website/.eleventy.js

@@ -32,11 +32,26 @@ const MANUAL_PAGE_ORDER = {
     ]
 };
 
+// Removes HTML tags until none are left, so that nested input such as
+// "<<b>script>" cannot reassemble a tag after a single pass.
+function stripHtmlTags(value) {
+    let previous;
+    let current = value;
+
+    do {
+        previous = current;
+        current = current.replace(/<[^>]+>/g, "");
+    } while (current !== previous);
+
+    return current;
+}
+
 function markdownToPlainText(value) {
-    return (value || "")
+    const withoutLinks = (value || "")
         .replace(/!\[([^\]]*)\]\([^)]+\)/g, "$1")
-        .replace(/\[([^\]]+)\]\([^)]+\)/g, "$1")
+        .replace(/\[([^\]]+)\]\([^)]+\)/g, "$1");
-        .replace(/<[^>]+>/g, "")
+
+    return stripHtmlTags(withoutLinks)
         .replace(/[*_~`]/g, "")
         .replace(/\s+/g, " ")
         .trim();

website/scripts/validate-version-info.js

@@ -28,14 +28,29 @@ function extractTag(xml, tagName) {
     return match ? match[1].trim() : null;
 }
 
+// Applies the removal until nothing changes, so that nested input such as
+// "<!-<!---->-->" cannot leave a fresh comment behind after a single pass.
+function removeUntilStable(value, pattern) {
+    let previous;
+    let current = value;
+
+    do {
+        previous = current;
+        current = current.replace(pattern, "");
+    } while (current !== previous);
+
+    return current;
+}
+
 function assertWellFormedStructure(xml) {
     if (/&(?!amp;|lt;|gt;|quot;|apos;|#\d+;|#x[0-9a-f]+;)/i.test(xml)) {
         fail("the XML contains an unescaped ampersand");
     }
 
-    const withoutCommentsAndDeclaration = xml
+    const withoutCommentsAndDeclaration = removeUntilStable(
-        .replace(/<!--[\s\S]*?-->/g, "")
+        xml,
-        .replace(/<\?[\s\S]*?\?>/g, "");
+        /<!--[\s\S]*?-->|<\?[\s\S]*?\?>/g
+    );
 
     const tagPattern =
         /<\/?([A-Za-z_][\w:.-]*)(?:\s[^<>]*?)?\s*\/?>/g;