Repository navigation
fix: preserve literal input and static asset boundaries - #2757
Merged
Merged
Conversation
Escape project names before building hand-test patterns, compare transport identifiers as literal tokens, preserve boundaries when extracting prose and XML facts, and require canonical containment for smoke static assets. Add regression coverage for metacharacters, dollar identifiers, markup joining, traversal, symlinks, and malformed URL encoding. Signed-off-by: Martin Vogel <[email protected]>
Signed-off-by: Martin Vogel <[email protected]>
Owner
Author
|
Added the remaining architecture hand-test fixes in e30dd59. Graph node IDs now escape backslashes, quotes, and control characters in CSS selectors, and the project chooser treats project names as literal text instead of regular expressions. The new cases reproduced 11 failures twice before the fix; removing the fix restored the same failures. With the fix restored, all 75 affected tests across five files pass. JavaScript syntax checks and the diff whitespace check also pass. Hosted CodeQL still needs to confirm the result; the PR remains a draft while those checks run. Thanks for reviewing these fixes and helping improve the CI checks. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Main CodeQL analysis succeeds, but its open-alert gate fails on ten existing JavaScript findings. This change addresses the affected input handling without changing the scanning scope or alert gate.
$identifiers.Validation: the first eight fixes reproduced 11 deterministic regression failures twice, and reverting the fixes restored those failures. The remaining two locator fixes likewise reproduced 11 failures twice, passed after the fix, and failed again on revert. The final affected batch passes all 75 tests across five files. Changed JavaScript modules passed syntax checks, and
git diff --checkis clean.Hosted checks on head e30dd59 are green: dco, ci-ok, test-ui (including the production UI build and the new unit tests), test-windows-guards, and CodeQL javascript-typescript. The CodeQL analysis of the PR merge commit reports 0 open alerts. No alerts are dismissed or suppressed.