ci: gate pushes with a11y-smoke and resolve the deferred code-scanning findings - #631
Merged
Conversation
…g findings - a11y-smoke.yml now runs on push to main and release/**, so a violation can no longer land unscanned between pull requests - every workflow declares a top-level permissions block (contents: read) - OfficeDocumentPreview keeps only http, https, mailto and tel links in rendered Word documents instead of stripping a javascript: prefix - trailing-slash normalisation of admin-supplied LLM base URLs uses a loop helper rather than a regex that backtracks on long slash runs - forecast and test-run console.error calls pass ids as format arguments Closes #605
The in-memory fallback buckets on Math.floor(Date.now() / 1000). A2 made 50 awaited calls on the real clock, so on a slow runner the loop crossed a second boundary, the counter restarted, and the 50th call reported 4 remaining instead of 0. C1 had the same exposure over three calls. Both now freeze the clock with fake timers, as B2, C2 and C3 already do.
Contributor
Author
|
🎉 This PR is included in version 1.0.5 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Post-1.0 hardening deferred from the v1.0.0 release: the two CI gaps and the deferred code-scanning findings recorded in #605.
CI
a11y-smoke.ymlnow also runs on push tomainandrelease/**(with its own path in both filters), so a critical violation can no longer sit on a release branch unscanned between pull requests.betais not in the list because it was retired in ci(release): drop the retired beta branch from every workflow trigger #628.permissions:block now declarecontents: read. CodeQL had only flagged the three whose jobs carry no block at all (a11y-smoke,db-integration,e2e-smoke); the five release workflows already grant write per job, so there this documents the existing guarantee with no behavior change.Code scanning
OfficeDocumentPreview.tsx(incomplete URL scheme check): confirmed as a real gap. Thehrefof a link in a rendered Word document stays in the DOM withtarget="_blank", and only a literaljavascript:prefix was stripped. Links now go through the URL parser and keep theirhrefonly forhttp:,https:,mailto:andtel:, which also coversdata:,vbscript:and tab-obfuscated schemes.anthropic.adapter.ts,pricing.tsx2):/\/+$/backtracks quadratically on long runs of/. The three flagged sites now use a newstripTrailingSlashesloop helper inlib/utils/url.ts. Identical regexes elsewhere were not flagged and are unchanged.forecastService.ts,testRunService.ts): triaged as benign. Each site is a multi-argumentconsole.errorwhose first argument interpolates an id, so a%sin the id could only garble a log line. All seven calls now pass a literal%sformat with the id as an argument, so the alert stops reappearing on every line shift.The
stripHtmlTags.tsand available-models SSRF findings were assessed and dismissed in the issue and are untouched here.Related Issue
Closes #605
Type of Change
How Has This Been Tested?
New tests:
lib/utils/url.test.ts(including a 200k-slash input that would time out under the regex), a Word-preview test that rendersjavascript:,data:andvbscript:links and checks they lose theirhrefwhile anhttps:link getstargetandrel, and an adapter test that a base URL with trailing slashes still requests.../v1/messages.testRunService.test.tsassertions were updated for the newconsole.errorargument shape.The full
pnpm precommitchain (ESLint, type-check, Prettier, case-status check, full Vitest suite, docs build) passes locally.Test Configuration:
Checklist
Screenshots (if applicable)
n/a
Additional Notes
ci:title cuts no release.ubuntu-latestjobs per qualifying push tomainorrelease/**.#anchor) in Word previews resolve tohttp(s):and still open in a new tab, which predates this change; and thebuild-clijob incli-release.ymlholdscontents: writeit does not use.