Update review state with X-Frame-Options clickjacking finding

[BodenMcHale]

Summary

Updates the code review state tracking to record a newly identified security finding in the checkXFrameOptions function and updates related issue references.

Key Changes

• New Finding Filed (Issue [REVIEW] X-Frame-Options: checkXFrameOptions awards 15/15 "good" for any frame-ancestors value — including frame-ancestors * which provides zero clickjacking protection #23): Documented that checkXFrameOptions in src/rules.ts:76-85 incorrectly awards full points (15/15 "good") for any frame-ancestors directive value, including the insecure frame-ancestors * which provides zero clickjacking protection. The function only checks for the directive's presence via regex but never validates the actual directive value.

  • Score: 8.10 (high user impact and security severity)
  • Root cause: /frame-ancestors/i regex detection without value inspection

• Updated Runner-Up References: Clarified that several previously identified findings are now covered by open issues:

  • CSP wildcard regex limitation → Issue [REVIEW] CSP: wildcard (*) detection covers only default-src and script-src — connect-src *, form-action *, and mid-policy wildcards silently pass #16
  • CSP-Report-Only header handling → Issue [REVIEW] CSP: Content-Security-Policy-Report-Only is invisible to the analyzer — report-only deployments score 0/30 as if no CSP exists #20
  • Referrer-Policy classification → Issue [REVIEW] Referrer-Policy: no-referrer-when-downgrade classified as "strong" — awards full score for the historical browser default that leaks full URLs cross-origin #18
  • base-uri directive gap → Issue [REVIEW] CSP: checkCSP awards full score without verifying base-uri restriction, enabling silent <base> injection bypass #5 (marked as closed/resolved)

• Updated Verification Notes: Replaced outdated X-Frame-Options verification note with current status on open Dependabot PRs

Implementation Details

The finding highlights a validation gap where the presence of frame-ancestors is treated as sufficient security, but the directive's value (which determines actual protection level) is never evaluated. This is a clear case where regex-based detection without semantic analysis leads to false positives in the security scoring.

https://claude.ai/code/session_016gPFAX6ruHXyEB7N34Sfq1