# AP — textiq-admin-portal
**PIC:** TruongTQ20  |  **Generated:** 2026-06-17 14.13

**Links:** [Sonar](https://sonar.fsoft.com.vn/dashboard?id=AI1.AI4SE.TextIQ.textiq-admin-portal&branch=dev&codeScope=overall) | [Coverity](https://coverity.fsoft.com.vn:443/query/defects.htm?stream=AI1.AI4SE.TextIQ.textiq-admin-portal&outstanding=true) | [BlackDuck](https://blackduck.fsoft.com.vn/api/projects/bf9f0883-4aa7-4aa7-8b2d-debef01e89fa/versions/caf3c0a1-d38d-4a2e-8c1a-3034ff477dfe/components)

## Sonar Issues

| # | Sev | Type | Rule | File:Line | Message |
|---|-----|------|------|-----------|---------|
| 1 | 🔴 CRITICAL | CODE_SMELL | `typescript:S1541` | `src/features/code-analysis/components/wiki-progress-card.tsx:371` | Function has a complexity of 14 which is greater than 10 authorized. |
| 2 | 🔴 CRITICAL | CODE_SMELL | `typescript:S1541` | `src/features/code-analysis/components/wiki-progress-card.tsx:411` | Function has a complexity of 12 which is greater than 10 authorized. |
| 3 | 🔴 CRITICAL | CODE_SMELL | `typescript:S1192` | `src/features/user-management/components/__tests__/add-user-modal.test.tsx:95` | Define a constant instead of duplicating this literal 6 times. |
| 4 | 🟣 HOTSPOT | SECURITY_HOTSPOT | `typescript:S5852` | `src/features/node-management/utils/derive-code.ts:21` | Make sure the regex used here, which is vulnerable to super-linear runtime due to backtracking, cannot lead to denial of |

## Coverity Defects

| # | Impact | CID | Checker | File:Line | Function |
|---|--------|-----|---------|-----------|----------|
| 1 | 🔴 High | 983660 | `DOM_XSS` |  | redirectToLogin |
| 2 | 🟠 Medium | 847614 | `REVERSE_INULL` |  | <anonymous> |
| 3 | 🟠 Medium | 983663 | `COPY_PASTE_ERROR` |  | SignUpViewPage |
| 4 | 🟠 Medium | 1101638 | `FORWARD_NULL` |  | <anonymous> |
| 5 | 🟠 Medium | 1101649 | `DEADCODE` |  | <anonymous> |
| 6 | 🟠 Medium | 1101653 | `FORWARD_NULL` |  | useGraphNeighbors |
| 7 | 🟠 Medium | 1101656 | `DEADCODE` |  | <anonymous> |

## BlackDuck Vulnerabilities

| # | Severity | CVE | Component | Version | Description |
|---|----------|-----|-----------|---------|-------------|
| 1 | 🟠 MEDIUM | CVE-2026-30691 | @cyntler/react-doc-viewer | 1.17.1 | Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .t |
| 2 | 🟠 MEDIUM | BDSA-2023-0967 | js-xlsx | 0.18.5 | SheetJS contains a prototype pollution vulnerability. A remote unauthenticated attacker could exploit this vulnerability by using a crafted file in or |
| 3 | 🟠 MEDIUM | BDSA-2021-4043 | object-path | 0.6.0 | jointjs is vulnerable to a prototype pollution attack due to a type confusion error which can lead to a bypass of **CVE-2020-15256** (**BDSA-2020-3019 |