ace: Remote Property Injection, Incorrect suffix check, Missing regular expression anchor, and Overly permissive regular expression range

Hello Ace Team,

First of all, thank you for this amazing library! We have been using it for over 4 years now, and it provides amazing robust capabilities for our in app code editor interface.

As part of our implementation, we need to resolve potential reported security vulnerabilities recorded by Github's CodeQL engine, including:

The following are the issues, present in multiple locations/files, and has not been previously reported on the issues list:

1. Remote Property Injection

- /worker-xquery.js,
- /worker-coffee.js,
- /worker-yaml.js,
- /worker-javascript.js,
- /worker-html.js,
- /worker-php.js,
- /worker-css.js,
- /worker-xml.js,
- /worker-lua.js,
- /worker-json.js,
- /worker-base.js

2. Incorrect suffix check

- /worker-coffee.js

3. Missing regular expression anchor

- /ace.js

4. Overly permissive regular expression range

- /worker-css.js
- /ext-inline_autocomplete.js
- /mode-asl.js
- /ext-language_tools.js

We did attempt to follow procedure by reporting to hackerone.com, however hacker one only resolves known/reproducible issues, we are looking for the opposite (confirmation of false positive).

Expected Behavior
*
From all of our research, it appears that all issues cited on worker.js and worker_v2.js are indeed false positives, due to the file only being imported via new Worker(), which prevents any XSS vulnerabilities due to the same origin requirement.

Current Behavior
*
CodeQL Scanners in GitHub Flag many Critical and High vulnerabilities in our clone of ajaxorg/ace.

Reproduction Steps
*
- Go to [Security](https://github.com/ajaxorg/ace/security) tab in ajax/ace
- Click 'Code scanning'
- Review the issue listed above

If that does not reproduce, you can also view them by enabling CodeQL scanner on your repository:

- Go to [Settings > Advanced Security](https://github.com/zilvertonz/healthcheck_doctor/settings/security_analysis) tab in ajaxorg/ace
- Under Code Scanning > Tools, turn on CodeQL analysis for master

Possible Solution
Declare the above to be false positives, or acknowledge them as potential issues that will be investigated.

Additional Information/Context
We have already reach out to your team previously related to false positives and we really appreciate your time for being responsive and providing the detailed information needed.
https://github.com/ajaxorg/ace/issues/5829

Please feel free to reach out to us if you need further information on reported issues.

Thank you team.

Ace Version / Browser / OS / Keyboard layout
*
1.39.0/chrome/windows/qwerty