Repository navigation
[AI Improvement] [Task] Remove useless escapes (no-useless-escape), fix three prompt/widget typos, and remove its warn override #11344
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
33cf4bb
c8bab45
d2c924a
5a86fc5
ee6fe7b
80cc627
4100038
04a7fdc
5de5127
5e5e9c9
ebf59ac
00ebe85
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,7 +9,7 @@ import { Options } from "../options"; | |
| import { isVSCodeExtension } from "../vsCodeUtils"; | ||
|
|
||
| function runCommand(command: string, childOptions: childProcess.SpawnOptions) { | ||
| const escapedCommand = command.replace(/\"/g, '\\"'); | ||
| const escapedCommand = command.replace(/"/g, '\\"'); | ||
|
Member
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. SUGGESTION (security) No change requested here. CodeQL's "Incomplete string escaping or encoding" alert on this line is a re-report, not something this PR introduced. The same alert is already open on It also isn't a real security risk. The input is the developer's own "Escape backslashes first" is the wrong fix. It would change how every existing hook that contains a backslash or Rule: general/codeql-triage
Member
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Acknowledged. Thank you for the detailed context and CodeQL triage analysis! Leaving this line as-is in this PR. |
||
| const nodeExecutable = isVSCodeExtension() ? "node" : process.execPath; | ||
| const crossEnvShellPath = isVSCodeExtension() | ||
| ? path.resolve(__dirname, "./cross-env/dist/bin/cross-env-shell.js") | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| import { expect } from "chai"; | ||
|
|
||
| import { WIDGET_UI } from "./widget_ui"; | ||
|
|
||
| describe("WIDGET_UI", () => { | ||
| it("should only treat provider IDs with a literal 'saml.' prefix as SAML providers", () => { | ||
| // The script is built from a template literal, so the source needs `\\.` for the browser to receive `\.`. | ||
| expect(WIDGET_UI).to.include("providerId.match(/^saml\\./)"); | ||
| }); | ||
| }); |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -34,7 +34,7 @@ var firebaseAppId = query.get('appId'); | |
| var apn = query.get('apn'); | ||
| var ibi = query.get('ibi'); | ||
| var appIdentifier = apn || ibi; | ||
| var isSamlProvider = !!providerId.match(/^saml\./); | ||
| var isSamlProvider = !!providerId.match(/^saml\\./); | ||
|
Member
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. SUGGESTION (reliability) The fix is correct and intended. I evaluated the cooked Effect on provider IDs:
Before, those IDs got an extra Nothing tests // src/emulator/auth/widget_ui.spec.ts
import { expect } from "chai";
import { WIDGET_UI } from "./widget_ui";
describe("WIDGET_UI", () => {
it("should only treat provider IDs with a literal 'saml.' prefix as SAML providers", () => {
// The script is built from a template literal, so the source needs `\\.` for the browser to receive `\.`.
expect(WIDGET_UI).to.include("providerId.match(/^saml\\./)");
});
});Rule: firebase-tools-pr-review/testing-discipline
Member
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Added |
||
| assert( | ||
| appName || clientId || firebaseAppId || appIdentifier, | ||
| 'Missing one of appName / clientId / appId / apn / ibi query params.' | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -191,10 +191,10 @@ interface EmulatedTriggerRecord { | |
|
|
||
| export function createIgnoredFilter(ignore?: string[]): chokidar.Matcher[] { | ||
| const ignored: chokidar.Matcher[] = [ | ||
| /(^|[\/\\])\../, // Ignore hidden files/dirs (covers .dart_tool, .git, etc.) | ||
| /(^|[/\\])\../, // Ignore hidden files/dirs (covers .dart_tool, .git, etc.) | ||
| /.+\.log/, // Ignore log files | ||
| /.+?[\\\/]node_modules[\\\/].+?/, // Ignore node_modules | ||
| /.+?[\\\/]venv[\\\/].+?/, // Ignore venv | ||
| /.+?[\\/]node_modules[\\/].+?/, // Ignore node_modules | ||
| /.+?[\\/]venv[\\/].+?/, // Ignore venv | ||
| ]; | ||
| if (ignore) { | ||
| const minimatchInstances = ignore.map((pattern) => { | ||
|
|
@@ -1948,7 +1948,7 @@ export class FunctionsEmulator implements EmulatorInstance { | |
| // req.url = /:projectId/:region/:trigger_name/* | ||
| const url = new URL(`${req.protocol}://${req.hostname}${req.url}`); | ||
| let path = `${url.pathname}${url.search}`.replace( | ||
| new RegExp(`\/${this.args.projectId}\/[^\/]*\/${req.params.trigger_name}\/?`), | ||
| new RegExp(`/${this.args.projectId}/[^/]*/${req.params.trigger_name}/?`), | ||
|
joehan marked this conversation as resolved.
Dismissed
Member
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. SUGGESTION (security) No change requested here. The "Regular expression injection" alert is also a re-report. It is open on In practice it isn't exploitable. Proper follow-up: wrap both interpolations in lodash's Rule: general/codeql-triage
Member
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Acknowledged. Keeping this regex replacement strictly to the useless escape removal and leaving further sanitization/prefix trimming for a dedicated follow-up per b/576834330's scope boundaries. |
||
| "/", | ||
| ); | ||
|
|
||
|
|
||
Uh oh!
There was an error while loading. Please reload this page.