[dev] [Marfuen] mariano/comp-190-unable-to-edit-policy-name-or-description-after-creating#839
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
1 Skipped Deployment
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| .max(1000, "Comment content should be at most 1000 characters") | ||
| .transform((val) => { | ||
| // Remove any HTML tags | ||
| return val.replace(/<[^>]*>/g, ""); |
Check failure
Code scanning / CodeQL
Incomplete multi-character sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 12 months ago
To address the issue, we will replace the current single-pass regular expression sanitization with a more robust approach. Specifically, we will repeatedly apply the regular expression replacement until no more matches are found. This ensures that all instances of HTML tags, including nested or malformed ones, are removed. Additionally, we will consider using a well-tested library like sanitize-html for more comprehensive sanitization if the project allows external dependencies.
The fix involves modifying the .transform() function in the addCommentSchema to repeatedly apply the regular expression replacement. This ensures that all HTML tags are removed, even in edge cases.
| @@ -325,4 +325,9 @@ | ||
| .transform((val) => { | ||
| // Remove any HTML tags | ||
| return val.replace(/<[^>]*>/g, ""); | ||
| // Remove any HTML tags, including nested or malformed ones | ||
| let previous; | ||
| do { | ||
| previous = val; | ||
| val = val.replace(/<[^>]*>/g, ""); | ||
| } while (val !== previous); | ||
| return val; | ||
| }), |
Marfuen
deleted the
mariano/comp-190-unable-to-edit-policy-name-or-description-after-creating
branch
Marfuen
restored the
mariano/comp-190-unable-to-edit-policy-name-or-description-after-creating
branch
|
🎉 This PR is included in version 1.36.3 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
3 participants
This is an automated pull request to merge mariano/comp-190-unable-to-edit-policy-name-or-description-after-creating into dev.
It was created by the [Auto Pull Request] action.