SQL Injection, JSON injection and XSS detected after SAST execution

[kokart]

After a SAST execution we have detected differents issues.

These are critical:
SQL_INJECTION.pdf
INJECTION JSON.pdf
CROSS-SITING DOM.pdf

I've attached the related report in Spanish , but the full report shows more issues:

Thank you

[asmecher]

@kokart, please see https://github.com/pkp/ojs/blob/main/SECURITY.md for details on responsible disclosure of potential security issues.

The SQL_INJECTION.pdf document relates to code in the Laravel dependency, not our codebase. At a glance, these are false positives -- the queries in question are not supplied with data from remote users. If you're still concerned about them, however, you could submit them to the Laravel project.

If you're willing to replicate these issues and provide details, then they could be valuable; raw reports out of SAST tools typically produce a lot of false positives and are very time-consuming to work with. Especially in Spanish, which is not my strongest language!