mirror of
https://github.com/pezkuwichain/pezkuwi-extension.git
synced 2026-10-26 21:39:52 +00:00
SatoshiQaziMuhammed
d4c8c5f26e
* fix(ui): leave no angle bracket in a sanitized origin; judge markup on the raw one sanitizeOrigin removed tags in a single pass, so `<scr<script>ipt>` came out as `<script` (CodeQL js/incomplete-multi-character-sanitization #6, #7). The page renders the result as React text, so this was not exploitable here, but the helper's name promised more than it did. It now also drops every remaining `<` and `>`. validateOrigin looked for markup in the sanitized string, after the tags had been removed, so `<b>x</b>` passed as a valid origin. It now checks the raw origin first. pr-any.yml gets permissions: contents: read and lock.yml the issues/pull-requests/discussions write it needs (CodeQL actions/missing-workflow-permissions #3, #23). * test(ui): typed cases and the matchers the test shim implements The first version used it.each (untyped rows, @typescript-eslint/no-unsafe-argument) and expect().not.toMatch, which @pezkuwi/dev-test does not implement. Plain loops over string[] and a boolean assertion instead. With the repo runner: 5/5 pass on the fix, 3 of 5 fail on main's sanitizeOrigin.ts.