Close the family-nav host check at the slash - #65
Merged
Conversation
`startsWith(BASE)` is a prefix test on a URL, and a host name may continue where the prefix stops: `https://abap2ui5.github.io.example.com/samples/` starts with `https://abap2ui5.github.io` and was therefore collected as one of "our" links and compared, in order, against the wanted list. The check that exists to say which three pages the bar links to would have counted a link to somebody else as one of them. With the trailing slash the host is closed and the prefix can only match this origin. Every real link already carries it, so nothing about the current pages changes - this is the case the check could not have caught. The body is shared with abap2UI5/.github/shared/check-family-nav.mjs and the two sibling repositories; it is changed in all four or in none.
`A2UI5_URL_RE` was `/github\.com\/abap2UI5\/abap2UI5/`, tested against a whole
`{...}` slice of a "dependencies" array. It matched anywhere in the slice and
it stopped at the repository name without closing it, so
`https://github.com/abap2UI5/abap2UI5-local` - a different repository in the
same organisation, and a plausible thing for an abaplint config to depend on -
was read as the framework and had its "branch" key checked, allowlisted and
reported as if it were.
Anchoring at the `"url"` key and closing at the quote leaves only the
framework. Output is byte-identical on every config in this repository today
(same entry counts, same release, same allowlisted pins); the difference is
the entry that does not exist yet.
CodeQL reports the old form as js/regex/missing-regexp-anchor, high severity.
The file is byte-identical with abap2UI5/.github/shared/check-framework-pin.mjs
and the sibling copy, and is synced from there - changed in all three or in
none.
oblomov-dev
pushed a commit
to abap2UI5/abap2UI5
that referenced
this pull request
Aug 29, 2026
`startsWith(BASE)` is a prefix test on a URL, and a host name may continue where the prefix stops: `https://abap2ui5.github.io.example.com/samples/` starts with `https://abap2ui5.github.io` and was therefore collected as one of "our" links and compared, in order, against the wanted list. The check that exists to say which three pages the bar links to would have counted a link to somebody else as one of them. With the trailing slash the host is closed and the prefix can only match this origin. Every real link already carries it, so nothing about the current pages changes - this is the case the check could not have caught. This is the two high-severity alerts CodeQL reported against #2679: js/incomplete-url-substring-sanitization, twice in this file. Reproduced locally with this repository's own codeql.yaml configuration (security-extended, same paths), confirmed gone after the change, and the rest of the result set unchanged. The body is shared with the three sample repositories and gated against them; the matching pull requests are abap2UI5/samples#809, abap2UI5/samples-controls#166 and abap2UI5/samples-stack#65, and they merge first - check:shared reads the consumers from their main.
oblomov-dev
pushed a commit
to abap2UI5/abap2UI5
that referenced
this pull request
Aug 29, 2026
`A2UI5_URL_RE` was `/github\.com\/abap2UI5\/abap2UI5/`, tested against a whole
`{...}` slice of a "dependencies" array. It matched anywhere in the slice and
it stopped at the repository name without closing it, so
`https://github.com/abap2UI5/abap2UI5-local` - a different repository in the
same organisation, and a plausible thing for an abaplint config to depend on -
was read as the framework and had its "branch" key checked, allowlisted and
reported as if it were.
Anchoring at the `"url"` key and closing at the quote leaves only the
framework. Output is byte-identical on every config in both consumers today
(same entry counts, same release, same allowlisted pins); the difference is
the entry that does not exist yet.
CodeQL reports the old form as js/regex/missing-regexp-anchor, high severity,
and stops reporting it after this change.
Synced to abap2UI5/samples#809 and abap2UI5/samples-stack#65, which merge
first.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
scripts/check-family-nav.mjscollected "our" links withh.startsWith(BASE), whereBASEishttps://abap2ui5.github.io— a prefixtest on a URL that a host name may continue past.
https://abap2ui5.github.io.example.com/samples/starts with it, so a link tosomebody else entirely would have been collected as one of the three and
compared, in order, against the wanted list. The check whose whole job is to
say which pages the bar links to could not have caught that.
With the trailing slash (
https://abap2ui5.github.io/) the host is closed andthe prefix can only match this origin. Every real link already carries it, so
nothing about the current pages changes.
Found by reproducing this organisation's CodeQL configuration locally
(
security-extended): it isjs/incomplete-url-substring-sanitization, highseverity, twice in this file. Verified gone after the change, with the rest of
the result set unchanged.
The body of this file is shared with
abap2UI5/.github/shared/check-family-nav.mjsand the two sibling sample repositories, and is gated against them — it is
changed in all four or in none. The matching pull requests are open in
samplesandsamples-controls; theabap2UI5half follows once these aremerged, because its gate reads the consumers from
main.node scripts/check-family-nav.mjspasses here and in both siblings.Generated by Claude Code