Repository navigation
[code-scanning-fix] Fix js/incomplete-multi-character-sanitization: use repeated HTML comment stripping - #75350
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the test-only change that reuses the existing HTML-comment stripping helper.
No open issues 🎉
What changed in this PR
Addresses the flagged incomplete-sanitization pattern in the PR sous-chef tests by reusing the existing HTML-comment stripping helper. Production code is unchanged.
Changes:
- Replaces single-pass comment removal with
stripHtmlComments, which repeats removal until stable and removes dangling openers.
| File | Description |
|---|---|
scripts/pr-sous-chef.test.mjs |
Uses the existing helper when checking assignment-request content. |
Review effort: Max (auto)
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅
|
|
✅ PR Code Quality Reviewer completed the code quality review.
|
|
✅ Ponytail Reviewer completed successfully! Ponytail ReviewerOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ PR Specification Reviewer completed successfully! PR Specification ReviewerOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft. Design Decision Gate 🏗️Outcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
✅ Test Quality Sentinel completed test quality analysis. Test Quality SentinelOutcome: The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible. Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.
|
|
🎉 This pull request is included in a new release. Release: |
Security Fix: Incomplete multi-character sanitization
Alert Number: #1067
Severity: High
Rule: js/incomplete-multi-character-sanitization
CWE: CWE-116
Vulnerability Description
A single-pass
replace(/<!--[\s\S]*?--!?>/g, "")can leave a<!--sequence behind (e.g. nested/overlapping markers).Location
Fix Applied
Changes Made:
stripHtmlCommentshelper, which repeats removal until stable and strips any residual<!--.Security Best Practices
Testing Considerations
node --test scripts/pr-sous-chef.test.mjs.Automated by: Code Scanning Fixer Workflow
Run ID: 42177378444