mirror of
https://github.com/pezkuwichain/pezkuwi-extension.git
synced 2026-10-28 14:29:51 +00:00
Satoshi Qazi Muhammed
c7eb0f157e
sanitizeOrigin removed tags in a single pass, so `<scr<script>ipt>` came out as `<script` (CodeQL js/incomplete-multi-character-sanitization #6, #7). The page renders the result as React text, so this was not exploitable here, but the helper's name promised more than it did. It now also drops every remaining `<` and `>`. validateOrigin looked for markup in the sanitized string, after the tags had been removed, so `<b>x</b>` passed as a valid origin. It now checks the raw origin first. pr-any.yml gets permissions: contents: read and lock.yml the issues/pull-requests/discussions write it needs (CodeQL actions/missing-workflow-permissions #3, #23).
37 lines
1.2 KiB
YAML
37 lines
1.2 KiB
YAML
name: PR
|
|
on: [pull_request]
|
|
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
pr:
|
|
strategy:
|
|
# Each step reports on its own; one red step must not cancel the others.
|
|
fail-fast: false
|
|
matrix:
|
|
step: ['lint', 'test', 'build', diff]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 'lts/*'
|
|
- name: ${{ matrix.step }}
|
|
run: |
|
|
corepack enable
|
|
yarn install --immutable
|
|
yarn ${{ matrix.step }}
|
|
# `yarn lint` runs eslint --fix and `yarn build` rewrites packageInfo.ts and
|
|
# the i18n catalogue, so both pass on a tree they changed. The committed
|
|
# tree must already be what they produce.
|
|
- name: tree unchanged
|
|
run: git diff --exit-code --stat
|
|
# The package.json each published package's build/ holds is what npm
|
|
# receives: entry points must exist, no ./build/ or ./cjs/cjs/ paths, no
|
|
# workspace: ranges (extension-base 0.62.19 went out with workspace:*).
|
|
- name: check built manifests
|
|
if: matrix.step == 'build'
|
|
run: python3 scripts/check-built-manifests.py . $(cat scripts/published-packages.txt)
|