make policheck nearly clean

[danmoseley]

• plotly is full of geopolitical terms that are assumed fine in context and it's not something we control anyway
• country and capital are fine in context so removed them where they were arbitrary strings
• tested locally with policheck.exe.

this makes us 98% clean which makes it easy to eyeball violations.

Microsoft Reviewers: Open in CodeFlow

[danmoseley]

@julioct also a different scanner detected the secret added in your change. I am excluding it as hopefully it is not in fact a secret...

[danmoseley]

Latest plotly is actually 2.34 .. maybe we need a readme next to it to say "update policheck xml when you update plotly version"

[julioct]

@julioct also a different scanner detected the secret added in your change. I am excluding it as hopefully it is not in fact a secret...

It was a password for a test user used in the Keycloak playground. It was already removed in this commit

[danmoseley]

Great, reverted that commit

[danmoseley]

@JamesNK @adamint note this file needs an update when getting a new plotly.

[JamesNK]

Latest plotly is actually 2.34 .. maybe we need a readme next to it to say "update policheck xml when you update plotly version"

Are wildcards supported? e.g.

<Exclusion Type="FileName">plotly-*.js</Exclusion>

[danmoseley]

No mention in the doc linked, but I should have confirmed by trying it..