Skip to content

Fix the two regex defects CodeQL flags in the build script #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
erseco merged 2 commits into from
Sep 19, 2026
Merged

Fix the two regex defects CodeQL flags in the build script #17

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
322ff3c
Fix the two regex defects CodeQL flags in the build script
erseco Sep 19, 2026
ac5107b
Widen the script end-tag match to every browser-tolerated form
erseco Sep 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions Jakefile.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
function extractScriptNames() {
console.log("Extracting script file names from index.html");

var regexScriptName = /<script src="(.*?)"><\/script>/g;
var regexScriptName = /<script src="(.*?)"><\/script[^>]*>/g;
Comment thread
erseco marked this conversation as resolved.
Dismissed
var scriptSection = regexScriptSection.exec(indexFile)[1];

// extract script names
Expand Down Expand Up @@ -107,7 +107,9 @@
// convert wildcard notation to proper regex
// *foo.jpg becomes ^.*foo\.jpg$
excludeFiles = excludeFiles.map(function(file) {
file = file.replace(/\./g, "\\.").replace("*", ".*", "g");
// * is deliberately left out of the escaped set: it is the wildcard,
// turned into .* on the next call.
file = file.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
file = "^" + file + "$";
return file;
});
Expand Down
Loading