Chore: live server restructuring using esbuild #7256
Conversation
Co-Authored-By: sriram@plane.so <sriram@plane.so>
Co-Authored-By: sriram@plane.so <sriram@plane.so>
Co-Authored-By: sriram@plane.so <sriram@plane.so>
Co-Authored-By: sriram@plane.so <sriram@plane.so>
Co-Authored-By: sriram@plane.so <sriram@plane.so>
Co-Authored-By: sriram@plane.so <sriram@plane.so>
Co-Authored-By: sriram@plane.so <sriram@plane.so>
Co-Authored-By: sriram@plane.so <sriram@plane.so>
Co-Authored-By: sriram@plane.so <sriram@plane.so>
…rver-restructuring
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Palanikannan1437
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| */ | ||
| export const extractTextFromHTML = (html: string): string => { | ||
| // Use a regex to extract text between tags | ||
| const textMatch = html.replace(/<[^>]*>/g, ""); |
Check failure
Code scanning / CodeQL
Incomplete multi-character sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 days ago
To fix the issue, we will modify the function to repeatedly apply the regular expression replacement until no more matches are found. This ensures that all HTML tags, including nested or malformed ones, are completely removed. Additionally, we will use a more robust approach to handle edge cases and ensure that the function reliably extracts text content from HTML.
The updated function will:
- Use a loop to repeatedly apply the regular expression replacement until no changes occur.
- Ensure that all HTML tags are removed, leaving only the plain text content.
| @@ -4,5 +4,9 @@ | ||
| export const extractTextFromHTML = (html: string): string => { | ||
| // Use a regex to extract text between tags | ||
| const textMatch = html.replace(/<[^>]*>/g, ""); | ||
| return textMatch || ""; | ||
| // Use a regex to extract text between tags, applying it repeatedly to handle nested or malformed tags | ||
| let previous; | ||
| do { | ||
| previous = html; | ||
| html = html.replace(/<[^>]*>/g, ""); | ||
| } while (html !== previous); | ||
| return html || ""; | ||
| }; |
| */ | ||
| export const extractTextFromHTML = (html: string): string => { | ||
| // Use a regex to extract text between tags | ||
| const textMatch = html.replace(/<[^>]*>/g, ""); |
Check failure
Code scanning / CodeQL
Incomplete multi-character sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 days ago
To address the issue, the function extractTextFromHTML should be updated to repeatedly apply the regular expression replacement until no more replacements can be performed. This ensures that all instances of unsafe patterns are removed. Additionally, using a well-tested library like sanitize-html is recommended for robust sanitization, but if external libraries are not an option, the repeated replacement approach is a viable alternative.
The fix involves:
- Modifying the
extractTextFromHTMLfunction to apply the regular expression replacement in a loop until the input stabilizes. - Ensuring that the function removes all HTML tags and nested patterns effectively.
| @@ -19,5 +19,9 @@ | ||
| export const extractTextFromHTML = (html: string): string => { | ||
| // Use a regex to extract text between tags | ||
| const textMatch = html.replace(/<[^>]*>/g, ""); | ||
| return textMatch || ""; | ||
| // Use a regex to extract text between tags repeatedly until no more replacements can be performed | ||
| let previous; | ||
| do { | ||
| previous = html; | ||
| html = html.replace(/<[^>]*>/g, ""); | ||
| } while (html !== previous); | ||
| return html || ""; | ||
| }; |
|
|
||
| export const extractTextFromHTML = (html: string): string => { | ||
| // Use a regex to extract text between tags | ||
| const textMatch = html.replace(/<[^>]*>/g, ""); |
Check failure
Code scanning / CodeQL
Polynomial regular expression used on uncontrolled data High
|
|
||
| export const extractTextFromHTML = (html: string): string => { | ||
| // Use a regex to extract text between tags | ||
| const textMatch = html.replace(/<[^>]*>/g, ""); |
Check failure
Code scanning / CodeQL
Incomplete multi-character sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 days ago
To fix the issue, we need to ensure that all potentially unsafe HTML content, including nested or malformed tags, is removed. The best approach is to use a well-tested library like sanitize-html to handle the sanitization process. This library is specifically designed to remove unsafe HTML content while preserving safe text. If using a library is not an option, we can implement a loop to repeatedly apply the regular expression until no more replacements occur, ensuring all tags are removed.
| @@ -197,6 +197,8 @@ | ||
|
|
||
| import sanitizeHtml from "sanitize-html"; | ||
|
|
||
| export const extractTextFromHTML = (html: string): string => { | ||
| // Use a regex to extract text between tags | ||
| const textMatch = html.replace(/<[^>]*>/g, ""); | ||
| return textMatch || ""; | ||
| // Use sanitize-html to remove all HTML tags and return plain text | ||
| const sanitizedText = sanitizeHtml(html, { allowedTags: [], allowedAttributes: {} }); | ||
| return sanitizedText || ""; | ||
| }; |
| @@ -73,3 +73,4 @@ | ||
| "y-protocols": "^1.0.6", | ||
| "yjs": "^13.6.20" | ||
| "yjs": "^13.6.20", | ||
| "sanitize-html": "^2.17.0" | ||
| }, |
| Package | Version | Security advisories |
| sanitize-html (npm) | 2.17.0 | None |
Description
Type of Change
Screenshots and Media (if applicable)
Test Scenarios
References