Skip to content

Potential fix for code scanning alert no. 8: Incomplete multi-character sanitization#12

Draft
studioframes wants to merge 1 commit into
mainfrom
alert-autofix-8
Draft

Potential fix for code scanning alert no. 8: Incomplete multi-character sanitization#12
studioframes wants to merge 1 commit into
mainfrom
alert-autofix-8

Conversation

@studioframes

Copy link
Copy Markdown
Owner

Potential fix for https://github.com/studioframes/Condense/security/code-scanning/8

Use iterative replacement until a fixed point is reached, so any comment marker sequences that re-form after an earlier replacement are also removed.

Best single fix in src/services/textService.js:

  • In the XML branch (around lines 156–158), replace the one-shot comment stripping with a small loop:
    • Start with output = input;
    • Repeatedly apply output = output.replace(/<!--[\s\S]*?-->/g, '')
    • Stop when no further changes occur.
  • Keep the existing whitespace-collapsing and extreme-mode logic unchanged.

No new imports or dependencies are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…er sanitization

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@github-actions

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

let previousOutput;
do {
previousOutput = output;
output = output.replace(/<!--[\s\S]*?-->/g, '');
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants