Fix high-severity CodeQL findings (ReDoS, double-escaping, fs-race)#57
Merged
Conversation
Resolve the 6 findings the release CodeQL gate flags (all pre-existing): - js/polynomial-redos in model/print.ts: replace /\n+$/ trailing-newline collapse with a linear scan - js/polynomial-redos in integrations/markdown.ts: FENCE_RE's \s* (which could match \n) narrowed to [ \t\r]* so it cannot overlap the newline boundary; CRLF fences still match - js/redos in web/highlight-js.ts: make the regex-literal heuristic's body alternatives mutually exclusive on first char (no backtracking); bare ']' outside a class still highlights - js/double-escaping in vscode/webview/main.ts: decode & LAST so entity decoding is the exact inverse of escapeHtml - js/file-system-race in vscode export-pdf test: assert on the written buffer instead of re-reading the path (removes the TOCTOU; all assertions kept) make ci green; behavior verified unchanged for valid inputs.
MelbourneDeveloper
force-pushed
the
tdbin
branch
from
July 12, 2026 02:10
17def05 to
eccc5e9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the 6 high-severity CodeQL findings that block the release gate (all pre-existing, traced to early commits — not this branch's dedup work). The v0.12.0 Release run failed on
Enforce no high/critical findings (release gate); nothing was published.js/polynomial-redosmodel/print.ts\n+$)js/polynomial-redosintegrations/markdown.tsFENCE_RE\s*→[ \t\r]*(can't overlap\n); CRLF still matchesjs/redosweb/highlight-js.ts]still highlightsjs/double-escapingvscode/webview/main.ts&LAST (exact inverse ofescapeHtml)js/file-system-racevscodeexport-pdf testEach fix was adversarially verified: vulnerable construct genuinely removed, behavior identical for valid inputs, and two verifier-caught regressions (bare-
]regex literals; CRLF fences) were corrected before commit.Gates
make ci→ exit 0 (fmt, ESLint, clippy deny-all, tests + coverage, build, bundle-size)🤖 Generated with Claude Code