-
Notifications
You must be signed in to change notification settings - Fork 207
Dev #1578
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Annotations from the provided diff:Linter: no-fix-mes
Linter: grumpy-devSarcastic, grumpy breakdown of the changes:
Linter: diagramsThe diagram represents the removal and addition of workflows and a minor configuration adjustment. Unable to render rich display Parse error on line 4: graph TD
A[.github/workflows/genai-blog-post.yml] -->|Removed| X[No Build Logic]
A[astro core getting bumped,decoupled docs.yaml improvement]
--- content blogs/tags split mgd
direct JSON observation breakable]
Linter: no-fix-mes
Linter: grumpy-devSarcastic, grumpy breakdown of the changes:
Linter: diagramsHere is a corrected mermaid diagram for the changes: graph TD
A[.github/workflows/genai-blog-post.yml] -->|Removed| X[No Build Logic]
B[.github/workflows/custom-action.yml] -->|Added| C[Custom Workflow Logic]
D[docs/astro.config.mjs] -->|Updated| E[Astro Configuration]
F[docs/package.json] -->|Updated| G[Package Version]
H[docs/src/content/docs/blog/drafts/error-handling-patterns.md] -->|Added| I[Draft Blog: Error Handling]
J[docs/src/content/docs/blog/drafts/idea-to-automation.md] -->|Added| K[Draft Blog: Idea to Automation]
Summary Table (Linter: stats):
|
|
||
// Regular expression for matching GitHub Flavored Markdown style warnings. | ||
// Example: > [!WARNING] | ||
// > This is a warning message. | ||
const GITHUB_MARKDOWN_WARNINGS_RX = | ||
/^\s*>\s*\[!(?<severity>NOTE|TIP|IMPORTANT|WARNING|CAUTION)\]\s*\n>\s*(?<message>.+)(?:\s*\n>\s*.*?)*?$/gim | ||
/^\s*>\s*\[!(?<severity>NOTE|TIP|IMPORTANT|WARNING|CAUTION)\]\s*\n>\s*(?<message>.+)(?:\s*\n>\s*.*?)*?$/gim; |
Check failure
Code scanning / CodeQL
Inefficient regular expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 30 days ago
To fix the issue, we need to rewrite the regular expression to eliminate the ambiguity caused by .*?
within the repetition pattern. Specifically, we can replace .*?
with a more specific sub-expression that avoids ambiguity. For example, instead of matching any character lazily, we can match characters that are not part of the repetition pattern (\n>
). This ensures that the regular expression does not backtrack excessively.
The updated regular expression will replace .*?
with [^>\n]*
, which matches any sequence of characters that are not >
or newline. This change removes the ambiguity and improves performance while preserving the intended functionality.
-
Copy modified line R36
@@ -35,3 +35,3 @@ | ||
const GITHUB_MARKDOWN_WARNINGS_RX = | ||
/^\s*>\s*\[!(?<severity>NOTE|TIP|IMPORTANT|WARNING|CAUTION)\]\s*\n>\s*(?<message>.+)(?:\s*\n>\s*.*?)*?$/gim; | ||
/^\s*>\s*\[!(?<severity>NOTE|TIP|IMPORTANT|WARNING|CAUTION)\]\s*\n>\s*(?<message>.+)(?:\s*\n>\s*[^>\n]*)*$/gim; | ||
|
} | ||
// Enclose in quotes if the value contains newlines or quotes, and escape quotes | ||
if (value.includes("\n") || value.includes('"')) { | ||
value = value.replace(/"/g, '\\"'); // Escape existing quotes |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
To fix the issue, the value.replace
operation should be updated to escape both double quotes and backslashes. This can be achieved by chaining two replace
calls or using a single regular expression that matches both characters. The best approach is to use a single regular expression with a global flag to ensure all occurrences are replaced. This ensures that the output is properly escaped and consistent with expected dotenv formatting.
Changes will be made to the dotEnvStringify
function in the file packages/core/src/dotenv.ts
. Specifically, the line value.replace(/"/g, '\\"')
will be replaced with value.replace(/["\\]/g, '\\$&')
, which escapes both double quotes and backslashes.
-
Copy modified line R52
@@ -51,3 +51,3 @@ | ||
if (value.includes("\n") || value.includes('"')) { | ||
value = value.replace(/"/g, '\\"'); // Escape existing quotes | ||
value = value.replace(/["\\]/g, '\\$&'); // Escape double quotes and backslashes | ||
return `${key}="${value}"`; |
|
||
return text | ||
if (/file=\w+\.\w+/.test(label)) { | ||
const m = /^\s*\`{3,}\w*\r?\n((.|\s)*)\r?\n\`{3,}\s*$/.exec(text); |
Check failure
Code scanning / CodeQL
Inefficient regular expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
To fix the issue, we need to rewrite the regular expression to remove the ambiguity caused by (.|\s)*
. Instead of using (.|\s)*
, we can use a more specific pattern that matches any character except backticks (```) directly. This avoids the ambiguity and ensures efficient matching.
The updated regular expression will replace (.|\s)*
with [^\
]*`, which matches zero or more characters that are not backticks. This change preserves the original functionality while eliminating the risk of exponential backtracking.
The fix will be applied to line 165 in the normalize
function within the file packages/core/src/fence.ts
.
-
Copy modified line R165
@@ -164,3 +164,3 @@ | ||
if (/file=\w+\.\w+/.test(label)) { | ||
const m = /^\s*\`{3,}\w*\r?\n((.|\s)*)\r?\n\`{3,}\s*$/.exec(text); | ||
const m = /^\s*\`{3,}\w*\r?\n([^\`]*)\r?\n\`{3,}\s*$/.exec(text); | ||
if (m) return m[1]; |
? `defAudio("${c.input_audio}")` | ||
: `unknown message` | ||
const renderJinja = (content: string) => | ||
`$\`${content.replace(/`/g, "\\`")}\`${/\{(%|\{)/.test(content) ? `.jinja(env.vars)` : ""}`; |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 month ago
To fix the issue, the content.replace
operation should be updated to escape backslashes in addition to backticks. This can be achieved by first replacing all backslashes (\
) with double backslashes (\\
) and then replacing backticks (\``) with escaped backticks (
\``). The order of these replacements is important to avoid double-escaping backslashes introduced during the first replacement.
The updated code will use a regular expression with the global flag (g
) to ensure all occurrences of the characters are replaced. This approach ensures that the string is properly sanitized for use in the intended context.
-
Copy modified line R145
@@ -144,3 +144,3 @@ | ||
const renderJinja = (content: string) => | ||
`$\`${content.replace(/`/g, "\\`")}\`${/\{(%|\{)/.test(content) ? `.jinja(env.vars)` : ""}`; | ||
`$\`${content.replace(/\\/g, "\\\\").replace(/`/g, "\\`")}\`${/\{(%|\{)/.test(content) ? `.jinja(env.vars)` : ""}`; | ||
const renderPart = (c: ChatCompletionContentPart) => |
.filter((s) => s !== undefined && s !== null) | ||
.map((l) => (l === "*" ? ".*?" : l.replace(/[^a-z0-9_]/gi, ""))) | ||
.join("|"); | ||
const startRx = new RegExp(`^[\r\n\s]*(\`{3,})(${lg})\s*\r?\n`, "i"); |
Check failure
Code scanning / CodeQL
Useless regular-expression character escape High
regular expression
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
To fix the issue, the escape sequence \s
in the string literal should be properly escaped as \\s
. This ensures that the backslash is preserved when the string is converted into a regular expression, and the intended meaning of \s
as a whitespace character is retained.
The fix involves updating the regular expression string on line 21 to use \\s
instead of \s
. Similarly, the regular expression on line 25 also contains \s
and should be updated to \\s
for consistency and correctness.
-
Copy modified line R21 -
Copy modified line R25
@@ -20,3 +20,3 @@ | ||
.join("|"); | ||
const startRx = new RegExp(`^[\r\n\s]*(\`{3,})(${lg})\s*\r?\n`, "i"); | ||
const startRx = new RegExp(`^[\\r\\n\\s]*(\`{3,})(${lg})\\s*\\r?\\n`, "i"); | ||
const mstart = startRx.exec(text); | ||
@@ -24,3 +24,3 @@ | ||
const n = mstart[1].length; | ||
const endRx = new RegExp(`\r?\n\`{${n},${n}}[\r\n\s]*$`, "i"); | ||
const endRx = new RegExp(`\\r?\\n\`{${n},${n}}[\\r\\n\\s]*$`, "i"); | ||
const mend = endRx.exec(text); |
.filter((s) => s !== undefined && s !== null) | ||
.map((l) => (l === "*" ? ".*?" : l.replace(/[^a-z0-9_]/gi, ""))) | ||
.join("|"); | ||
const startRx = new RegExp(`^[\r\n\s]*(\`{3,})(${lg})\s*\r?\n`, "i"); |
Check failure
Code scanning / CodeQL
Useless regular-expression character escape High
regular expression
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
To fix the issue, the \s
escape sequence in the string literal should be replaced with \\s
. This ensures that the backslash is correctly interpreted as part of the regular expression when the string is passed to the RegExp
constructor. Similarly, any other escape sequences in the regular expression should be reviewed and corrected if necessary.
The specific changes are:
- Update the
startRx
regular expression on line 21 to use\\s
instead of\s
. - Update the
endRx
regular expression on line 25 to use\\s
instead of\s
.
-
Copy modified line R21 -
Copy modified line R25
@@ -20,3 +20,3 @@ | ||
.join("|"); | ||
const startRx = new RegExp(`^[\r\n\s]*(\`{3,})(${lg})\s*\r?\n`, "i"); | ||
const startRx = new RegExp(`^[\\r\\n\\s]*(\`{3,})(${lg})\\s*\\r?\\n`, "i"); | ||
const mstart = startRx.exec(text); | ||
@@ -24,3 +24,3 @@ | ||
const n = mstart[1].length; | ||
const endRx = new RegExp(`\r?\n\`{${n},${n}}[\r\n\s]*$`, "i"); | ||
const endRx = new RegExp(`\\r?\\n\`{${n},${n}}[\\r\\n\\s]*$`, "i"); | ||
const mend = endRx.exec(text); |
const mstart = startRx.exec(text); | ||
if (mstart) { | ||
const n = mstart[1].length; | ||
const endRx = new RegExp(`\r?\n\`{${n},${n}}[\r\n\s]*$`, "i"); |
Check failure
Code scanning / CodeQL
Useless regular-expression character escape High
regular expression
} | ||
// Match against TypeScript, GitHub, and Azure DevOps regex patterns. | ||
for (const rx of ANNOTATIONS_RX) { | ||
for (const m of text.matchAll(rx)) addAnnotation(m); |
Check failure
Code scanning / CodeQL
Polynomial regular expression used on uncontrolled data High
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
return text?.replace(GITHUB_MARKDOWN_WARNINGS_RX, (s, ...args) => { | ||
const groups = args.at(-1); | ||
const { severity, message, suggestion } = groups; | ||
const sev = SEV_MAP[severity?.toLowerCase()] ?? "info"; | ||
const d = deleteUndefinedValues({ | ||
severity: sev, | ||
filename: "", | ||
range: [ | ||
[0, 0], // Start of range, 0-based index | ||
[0, Number.MAX_VALUE], // End of range, max value for columns | ||
], | ||
code: "", | ||
message, | ||
suggestion, | ||
}) satisfies Diagnostic; | ||
return convertAnnotationToItem(d); | ||
}); |
Check failure
Code scanning / CodeQL
Polynomial regular expression used on uncontrolled data High
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
return text | ||
?.replace( | ||
GITHUB_ANNOTATIONS_RX, | ||
( | ||
_, | ||
severity, | ||
file, | ||
line, | ||
endLine, | ||
__, | ||
code, | ||
message, | ||
suggestion, | ||
) => `> [!${severities[severity] || severity}] | ||
> ${message} (${file}#L${line} ${code || ""}) | ||
${suggestion ? `\`\`\`suggestion\n${suggestion}\n\`\`\`\n` : ""} | ||
` | ||
) | ||
?.replace( | ||
AZURE_DEVOPS_ANNOTATIONS_RX, | ||
(_, severity, file, line, __, code, message) => { | ||
return `> [!${severities[severity] || severity}] ${message} | ||
`, | ||
) |
Check failure
Code scanning / CodeQL
Polynomial regular expression used on uncontrolled data High
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
This
regular expression
library input
return text | ||
?.replace(/\[([^\]]+)\]\([^)]+\)/g, (m, n) => n) | ||
?.replace(/<\/?([^>]+)>/g, "") | ||
return text?.replace(/\[([^\]]+)\]\([^)]+\)/g, (m, n) => n)?.replace(/<\/?([^>]+)>/g, ""); |
Check failure
Code scanning / CodeQL
Polynomial regular expression used on uncontrolled data High
regular expression
library input
This
regular expression
library input
packages/core/test/changelog.test.ts
Outdated
const source = `ChangeLog:1@email_validator.py | ||
Description: Implement a function to validate both email addresses and URLs. | ||
OriginalCode@1-3: | ||
[1] # Placeholder for email validation logic | ||
[2] | ||
[3] # Placeholder for URL validation logic | ||
ChangedCode@1-10: | ||
[1] import re | ||
[2] | ||
[3] def validate_email(email): | ||
[4] # Simple regex pattern for validating an email address | ||
[5] pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$' | ||
[6] return re.match(pattern, email) is not None | ||
[7] | ||
[8] def validate_url(url): | ||
[9] # Simple regex pattern for validating a URL | ||
[10] pattern = r'^https?:\/\/[\w.-]+\.[a-zA-Z]{2,}.*$' | ||
[11] return re.match(pattern, url) is not None | ||
[12] | ||
[13] def validate_email_and_url(email, url): | ||
[14] return validate_email(email) and validate_url(url) | ||
` | ||
const res = parseChangeLogs(source) | ||
assert.equal(res.length, 1) | ||
assert.equal(res[0].filename, "email_validator.py") | ||
}) | ||
`; |
Check failure
Code scanning / CodeQL
Useless regular-expression character escape High test
regular expression
The escape sequence '\w' is equivalent to just 'w', so the sequence is not a character class when it is used in a
regular expression
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
To fix the issue, ensure that the escape sequence \.
is used correctly in the context of the regular expression or string literal. If the goal is to match a literal dot, ensure that the backslash is properly escaped when using a string literal (e.g., '\\.'
). If the escape sequence is unnecessary, remove the backslash to avoid confusion and potential errors.
In this case, we will review the relevant code and adjust the escape sequence as needed to ensure the regular expression behaves as intended.
-
Copy modified line R57 -
Copy modified line R62
@@ -56,3 +56,3 @@ | ||
[4] # Simple regex pattern for validating an email address | ||
[5] pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$' | ||
[5] pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$' | ||
[6] return re.match(pattern, email) is not None | ||
@@ -61,3 +61,3 @@ | ||
[9] # Simple regex pattern for validating a URL | ||
[10] pattern = r'^https?:\/\/[\w.-]+\.[a-zA-Z]{2,}.*$' | ||
[10] pattern = r'^https?:\\/\\/[\\w.-]+\\.[a-zA-Z]{2,}.*$' | ||
[11] return re.match(pattern, url) is not None |
"https://github.com/user-attachments/assets/a6e1935a-868e-4cca-9531-ad0ccdb9eace", | ||
); | ||
assert(resolved); | ||
assert(resolved.includes("githubusercontent.com")); |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High test
githubusercontent.com
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 days ago
To fix the problem, replace the substring check with a proper host check. Specifically, parse the resolved URL using the URL
constructor and check that the host
property is exactly raw.githubusercontent.com
or ends with .githubusercontent.com
. This ensures that only valid GitHub asset hosts are accepted, and not arbitrary hosts containing the substring. The change should be made in the test block at line 123 in packages/core/test/githubclient.test.ts
. No new methods are needed, but the test assertion should be updated to use the parsed host.
-
Copy modified lines R123-R127 -
Copy modified lines R134-R138
@@ -120,14 +120,22 @@ | ||
"https://github.com/user-attachments/assets/a6e1935a-868e-4cca-9531-ad0ccdb9eace", | ||
); | ||
assert(resolved); | ||
assert(resolved.includes("githubusercontent.com")); | ||
const parsedHost = new URL(resolved).host; | ||
assert( | ||
parsedHost === "raw.githubusercontent.com" || | ||
parsedHost.endsWith(".githubusercontent.com") | ||
); | ||
}); | ||
test("resolveAssetUrl - mp4", async () => { | ||
const resolved = await client.resolveAssetUrl( | ||
"https://github.com/user-attachments/assets/f7881bef-931d-4f76-8f63-b4d12b1f021e", | ||
); | ||
console.log(resolved); | ||
assert(resolved.includes("githubusercontent.com")); | ||
const parsedHost = new URL(resolved).host; | ||
assert( | ||
parsedHost === "raw.githubusercontent.com" || | ||
parsedHost.endsWith(".githubusercontent.com") | ||
); | ||
}); | ||
|
||
test("resolveAssetUrl - image - indirect", async () => { |
"https://github.com/user-attachments/assets/f7881bef-931d-4f76-8f63-b4d12b1f021e", | ||
); | ||
console.log(resolved); | ||
assert(resolved.includes("githubusercontent.com")); |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High test
githubusercontent.com
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 days ago
To fix the problem, the test should parse the returned URL and check that its host is exactly githubusercontent.com
or matches a whitelist of allowed hosts. This avoids the risk of matching substrings in the path, query, or a malicious host. The best way to do this is to use the standard URL
class to parse the URL and then assert that the host
property matches the expected value. Specifically, in packages/core/test/githubclient.test.ts
, lines 130 and 123 should be changed to parse the URL and check the host, rather than using includes
. No new dependencies are needed, as the URL
class is available in Node.js.
-
Copy modified lines R123-R124 -
Copy modified lines R131-R132
@@ -120,14 +120,16 @@ | ||
"https://github.com/user-attachments/assets/a6e1935a-868e-4cca-9531-ad0ccdb9eace", | ||
); | ||
assert(resolved); | ||
assert(resolved.includes("githubusercontent.com")); | ||
const parsedUrl = new URL(resolved); | ||
assert(parsedUrl.host === "githubusercontent.com"); | ||
}); | ||
test("resolveAssetUrl - mp4", async () => { | ||
const resolved = await client.resolveAssetUrl( | ||
"https://github.com/user-attachments/assets/f7881bef-931d-4f76-8f63-b4d12b1f021e", | ||
); | ||
console.log(resolved); | ||
assert(resolved.includes("githubusercontent.com")); | ||
const parsedUrl = new URL(resolved); | ||
assert(parsedUrl.host === "githubusercontent.com"); | ||
}); | ||
|
||
test("resolveAssetUrl - image - indirect", async () => { |
value = { model: value, source }; | ||
} | ||
const aliases = this._modelAliases[source]; | ||
const c = aliases[id] || (aliases[id] = { source }); |
Check warning
Code scanning / CodeQL
Prototype-polluting assignment Medium
library input
const c = aliases[id] || (aliases[id] = { source }); | ||
if (value === undefined || value.model === id) { | ||
dbg(`alias ${id}: deleting (source: ${source})`); | ||
delete aliases[id]; |
Check warning
Code scanning / CodeQL
Prototype-polluting assignment Medium
library input
} else if (typeof obj === "string") { | ||
if (quoteValues) { | ||
if (obj.includes("\n")) return fenceMD(obj); | ||
return `\`${obj.replace(/`/g, "\\`")}\``; |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
To fix the issue, we need to ensure that backslashes are escaped before escaping backticks. This can be achieved by chaining two replace
calls: the first to escape backslashes (\
) and the second to escape backticks (```). This ensures that all occurrences of these characters are properly escaped.
The fix will involve modifying the replace
call on line 56 to include an additional step for escaping backslashes. Specifically:
- Replace backslashes (
\
) with double backslashes (\\
). - Replace backticks (
\``) with escaped backticks (
\``).
This change will ensure that the string is correctly escaped for Markdown rendering.
-
Copy modified line R56
@@ -55,3 +55,3 @@ | ||
if (obj.includes("\n")) return fenceMD(obj); | ||
return `\`${obj.replace(/`/g, "\\`")}\``; | ||
return `\`${obj.replace(/\\/g, "\\\\").replace(/`/g, "\\`")}\``; | ||
} else return obj; |
if (obj.includes("\n")) return fenceMD(obj); | ||
return `\`${obj.replace(/`/g, "\\`")}\``; | ||
} else return obj; | ||
} else return quoteValues ? `\`${String(obj).replace(/`/g, "\\`")}\`` : String(obj); |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
To fix the issue, we need to ensure that backslashes are properly escaped in addition to backticks. This can be achieved by first replacing all backslashes (\
) with double backslashes (\\
) and then replacing backticks () with escaped backticks (
``). This order is important to avoid inadvertently escaping the backslashes added during the first replacement.
The fix involves modifying the replace
logic on line 58 to handle both backslashes and backticks. We will use a regular expression with the g
flag to ensure all occurrences are replaced.
-
Copy modified line R58
@@ -57,3 +57,3 @@ | ||
} else return obj; | ||
} else return quoteValues ? `\`${String(obj).replace(/`/g, "\\`")}\`` : String(obj); | ||
} else return quoteValues ? `\`${String(obj).replace(/\\/g, "\\\\").replace(/`/g, "\\`")}\`` : String(obj); | ||
}; |
… inputs and improved formatting
…ce and improved metadata link
… types in MdAstOptions
…dencies to devDependencies, and adding new TODO and debug logging scripts.
…on signature for clarity
…in cache, concurrency, host, model alias, and models modules
… for clarity and formatting
return b; | ||
} | ||
const res = | ||
trimTrailingSlash(b.replace(/\/openai\/deployments.*$/, "")) + `/openai/deployments`; |
Check failure
Code scanning / CodeQL
Polynomial regular expression used on uncontrolled data High
regular expression
library input
…ace is disabled (#1877)
…te MCP documentation (#1879)
…budget support (#1823) * Initial plan * Initial exploration and setup - understanding the codebase structure Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Implement line option for def() - dynamic range around center line Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Address review feedback: Add maxTokens support, use RangeOptions type, clarify slice usage Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Refactor token budget logic to eliminate code duplication Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Remove encoder from RangeOptions interface - encoder now passed separately by promptdom Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Update documentation for new line option with token budget support in def() function Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
…ctionality (#1882) * Initial plan * Add parentIssue support to GitHubClient.createIssue method Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Add documentation for createIssue method with parentIssue support Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Add GitHub sub-issues demo sample script Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Merge branch 'dev' into copilot/fix-025f35e5-f039-48c7-b1fb-5c718e55b7d8
…ate documentation (#1886) * Initial plan * Add system.mcp_read_resource system script with basic functionality and documentation Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Add integration tests and finalize system.mcp_read_resource implementation Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Refactor MCP resource reading tools: rename `mcp_read_resource` to `resource_read`, update documentation, and remove obsolete test scripts. * Update URL description in resource_read tool and remove required flag * Refactor resource handling: rename `resource_read` to `resources`, add `resource_list` tool, and update documentation. Remove obsolete scripts. * Update resource documentation to include system.resources tools Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
* Initial plan * Fix quiet mode for runPrompt console output Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Add comprehensive test for quiet mode console output Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Add documentation and demonstration for quiet mode fix Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Revert files as requested by @pelikhan Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Add `--issue` flag to CLI commands for GitHub issue creation and update output handling in runScriptInternal * Refactor poem output handling to display poem length instead of content * Refactor import statements to use type imports for better clarity and performance * Enhance runScriptInternal function to improve output handling and formatting * Refactor output handling in createChatTurnGenerationContext and poem-inline.genai.mts for improved clarity --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
…mpt activation (#1887) * Initial plan * Add activation field to PromptSystemArgs and implement activation-based system resolution Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Complete implementation of activation field for system prompts with tests and integration Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Merge branch 'dev' into copilot/fix-e05d1306-4cde-4fa5-adce-543abae6d79c * Add explanatory comment for word boundary regex in activation keyword matching Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Merge branch 'dev' into copilot/fix-e05d1306-4cde-4fa5-adce-543abae6d79c * Add activation keywords for system.resources and support singular annotation Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…ssues (#1896) * Initial plan * Fix Docker container CWD path issue #1873 - use POSIX paths for Linux containers Co-authored-by: deyaaeldeen <6074665+deyaaeldeen@users.noreply.github.com> * Add osType option to ContainerOptions for Windows container support - Add osType?: "unix" | "windows" option to ContainerOptions interface - Default to "unix" for backward compatibility with existing Linux containers - Use appropriate path separators in docker.ts based on osType - Update comprehensive tests for both Unix and Windows container path handling - Update all type definition files to include new option Addresses feedback: Windows containers need backslash path separators, while Unix containers need forward slash separators. Co-authored-by: deyaaeldeen <6074665+deyaaeldeen@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: deyaaeldeen <6074665+deyaaeldeen@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
…maintaining domain filtering capability (#1895) * Initial plan * Implement domain filtering for HTTPS resources with configuration support Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Add comprehensive documentation for domain filtering feature Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Add domain filtering to fetchText function Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Refactor domain filtering to centralize default domains logic Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Move default domains to constants.ts and refactor domain filtering API Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Refactor domain handling in fetch functions and update allowed domains logic * Add configurable allowedDomains to PromptArgs for script-level domain filtering Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Fix globalThis.fetch to use consistent crossFetch for proxy support Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Revert changes in system.fetch tool as requested Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Add script-level allowedDomains configuration for fine-grained domain filtering Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Change default allowed domains to wildcard (*) and update documentation Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Fix JSDoc comment and update fetchText tests for wildcard domain default Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Fix tests: Update domain filtering tests for wildcard default and convert to vitest format Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Clarify domain filtering scope in documentation - host APIs only, not global fetch Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
describe("createDomainBlockedError", () => { | ||
test("creates descriptive error message", () => { | ||
const error = createDomainBlockedError("badsite.com", { allowedDomains: ["github.com", "*.openai.com"] }); | ||
assert(error.includes("badsite.com")); |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High test
badsite.com
Copilot Autofix
AI about 3 hours ago
Copilot could not generate an autofix suggestion
Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.
|
||
test("uses default domains in error message when no config provided", () => { | ||
const error = createDomainBlockedError("badsite.com", undefined); | ||
assert(error.includes("badsite.com")); |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High test
badsite.com
Copilot Autofix
AI about 3 hours ago
Copilot could not generate an autofix suggestion
Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.
assert.fail("Should have thrown error for unauthorized domain when allowedDomains is configured"); | ||
} catch (error) { | ||
assert(error.message.includes("Domain 'example.com' is not allowed")); | ||
assert(error.message.includes("github.com")); |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High test
github.com
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 days ago
To fix the problem, we should avoid using a substring check (includes("github.com")
) and instead parse the error message to extract the list of allowed domains, then assert that the expected domains are present in that list. Since the error message is expected to mention the allowed domains (as configured in the test), we can use a regular expression to extract the allowed domains from the error message and compare them to the expected list. This ensures that the test only passes if the error message correctly lists the allowed domains, and avoids accidental matches where "github.com" appears in an unrelated context.
Specifically, in packages/core/test/fetchtext.test.ts
, in the test "fetchText blocks domains when explicitly configured", replace the substring check on line 54 with logic that parses the allowed domains from the error message and asserts that both "github.com" and "*.github.com" are present.
No new imports are needed, as regular expressions and string manipulation are available in TypeScript/JavaScript.
-
Copy modified lines R54-R62
@@ -51,7 +51,15 @@ | ||
assert.fail("Should have thrown error for unauthorized domain when allowedDomains is configured"); | ||
} catch (error) { | ||
assert(error.message.includes("Domain 'example.com' is not allowed")); | ||
assert(error.message.includes("github.com")); | ||
// Extract allowed domains from the error message and check for both "github.com" and "*.github.com" | ||
const allowedDomainsMatch = error.message.match(/allowed domains?:?\s*(.*?)(?:\.|$)/i); | ||
if (allowedDomainsMatch) { | ||
const allowedDomainsStr = allowedDomainsMatch[1]; | ||
assert(allowedDomainsStr.includes("github.com")); | ||
assert(allowedDomainsStr.includes("*.github.com")); | ||
} else { | ||
assert.fail("Allowed domains not found in error message"); | ||
} | ||
assert(error.message.includes("GENAISCRIPT_ALLOWED_DOMAINS")); | ||
} | ||
}); |
* Refactor chat model selection logic for improved error handling and user experience * Add configuration option to prompt user for language chat model selection * Update haiku script to specify model version and enhance chat model mapping logic
* Initial plan * Initial analysis and planning for frontmatter parameter interpolation fix Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Fix frontmatter parameter interpolation in mustache.ts Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Enhance frontmatter parameter support for prompty format Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * genai: /docs [skip ci] --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…) (#1903) * Initial plan * Fix Windows path handling in VSCode extension context menu Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> * Add tests for Windows path handling fix Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Co-authored-by: Peli de Halleux <pelikhan@users.noreply.github.com>
Investigator reportContext collection
AI Analysis
|
Dev branch.