Repository navigation
fix(charts): strip title markup to a fixpoint, not one pass (code-sca… - #136
hyperpolymath wants to merge 2 commits into
Conversation
…nning 4, 5) Both open code-scanning alerts are the same rule, js/incomplete-multi-character-sanitization (CWE-020/080/116, high), on the same shape: text.replace(/<[^>]+>/g, '') stripping the pseudo-HTML Plotly accepts in titles. One pass can reintroduce the dangerous sequence — "<scr<script>ipt>" loses its inner tag and the halves join into a fresh "<script>" — so the strip now lives in one shared helper, stripHtmlTags in utils/text.ts, and repeats until the text stops changing. Behaviour on ordinary titles (CO<sub>2</sub>, <b>, <br>) is identical: the second pass finds nothing and changes nothing. Used at both flagged sites — the pane title width measurement in figure/charts.ts and the report figure title in components/AnalysisChart.tsx — and pinned by new tests in utils/text.test.ts covering the split-tag case, normal markup, and bare ">" text. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 40 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…etamanifold-webui
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
|
Closing as a duplicate: this branch's work (the code-scanning 4 and 5 sanitizer fix) already merged as #119 -- the branch was never deleted after the squash, so the 02:04 branch sweep opened it again against a base it predates. |
…nning 4, 5)
Both open code-scanning alerts are the same rule,
js/incomplete-multi-character-sanitization (CWE-020/080/116, high), on the same shape: text.replace(/<[^>]+>/g, '') stripping the pseudo-HTML Plotly accepts in titles. One pass can reintroduce the dangerous sequence — "<scr<script>ipt>" loses its inner tag and the halves join into a fresh "<script>" — so the strip now lives in one shared helper, stripHtmlTags in utils/text.ts, and repeats until the text stops changing. Behaviour on ordinary titles (CO2, ,
) is identical: the second pass finds nothing and changes nothing.
Used at both flagged sites — the pane title width measurement in figure/charts.ts and the report figure title in components/AnalysisChart.tsx — and pinned by new tests in utils/text.test.ts covering the split-tag case, normal markup, and bare ">" text.
Generated by Mistral Vibe.
Summary
Closes #
Type of change
How has this been verified?
Checklist
git commit -S).SPDX-License-Identifier(code/configMPL-2.0,prose
CC-BY-SA-4.0); I did not relicense existing files.Notes for reviewers