mirror of
https://github.com/pezkuwichain/pezkuwi-extension.git
synced 2026-10-22 19:56:20 +00:00
Satoshi Qazi Muhammed
c7eb0f157e
sanitizeOrigin removed tags in a single pass, so `<scr<script>ipt>` came out as `<script` (CodeQL js/incomplete-multi-character-sanitization #6, #7). The page renders the result as React text, so this was not exploitable here, but the helper's name promised more than it did. It now also drops every remaining `<` and `>`. validateOrigin looked for markup in the sanitized string, after the tags had been removed, so `<b>x</b>` passed as a valid origin. It now checks the raw origin first. pr-any.yml gets permissions: contents: read and lock.yml the issues/pull-requests/discussions write it needs (CodeQL actions/missing-workflow-permissions #3, #23).
31 lines
838 B
YAML
31 lines
838 B
YAML
name: 'Lock Threads'
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: '20 2/3 * * *'
|
|
|
|
|
|
permissions:
|
|
issues: write
|
|
pull-requests: write
|
|
discussions: write
|
|
|
|
jobs:
|
|
lock:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: dessant/lock-threads@v5
|
|
with:
|
|
github-token: ${{ github.token }}
|
|
issue-inactive-days: '7'
|
|
issue-comment: >
|
|
This thread has been automatically locked since there has not been
|
|
any recent activity after it was closed. Please open a new issue
|
|
if you think you have a related problem or query.
|
|
pr-inactive-days: '2'
|
|
pr-comment: >
|
|
This pull request has been automatically locked since there
|
|
has not been any recent activity after it was closed.
|
|
Please open a new issue for related bugs.
|