Skip to content

Potential fix for code scanning alert no. 1: Incomplete string escaping or encoding#425

Merged
jamespepper81 merged 2 commits into
devfrom
incomplete-string-escaping-or-encoding
Jan 8, 2026
Merged

Potential fix for code scanning alert no. 1: Incomplete string escaping or encoding#425
jamespepper81 merged 2 commits into
devfrom
incomplete-string-escaping-or-encoding

Conversation

@jamespepper81
Copy link
Copy Markdown
Contributor

Potential fix for https://github.com/BitSleuthAI/Wallet/security/code-scanning/1

In general, the way to fix this is to avoid using String.prototype.replace with a plain string when you intend to remove all occurrences of a character or pattern. Instead, use a regular expression with the g (global) flag, or a purpose-built parser that enforces and strips the expected syntax. This ensures there are no leftover meta-characters and removes the ambiguity that static analysis tools complain about.

For this specific case, the function is parsing BIP32 path components like "0'". The intent is to remove any ' characters before calling parseInt. The minimal, behavior-preserving change is to switch from part.replace("'", '') to part.replace(/'/g, ''), which removes all ' characters from the segment. This maintains the current logic but makes it correct even if a segment contains more than one '. No additional imports are needed, and no other parts of services/simple-bip32.ts need modifications.

Concretely, in services/simple-bip32.ts, inside the derivePath method of SimpleBIP32Node, update line 50 so that part.replace("'", '') becomes part.replace(/'/g, '').

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

jamespepper81 and others added 2 commits January 8, 2026 16:06
…ng or encoding

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@jamespepper81 jamespepper81 changed the base branch from main to dev January 8, 2026 16:53
@jamespepper81 jamespepper81 marked this pull request as ready for review January 8, 2026 16:57
@jamespepper81 jamespepper81 merged commit 2947d68 into dev Jan 8, 2026
3 checks passed
@jamespepper81 jamespepper81 deleted the incomplete-string-escaping-or-encoding branch January 8, 2026 16:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant