Repository navigation
fix: anchor github.com host match in usernameFromHref - #1
Merged
Merged
Conversation
The host regex lacked a trailing anchor, so lookalike hosts such as https://github.comx were stripped to a bare segment and parsed as a profile username. Require the path separator after the host. Resolves CodeQL js/regex/missing-regexp-anchor (alert #1).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
usernameFromHrefstripped the host with/^https?:\/\/github\.com/, which has no anchor after the hostname. Lookalike hosts were therefore parsed as profile links — e.g.https://github.comxyielded usernamex,https://github.com-evilyielded-evil.The pattern now requires the path separator after the host (
/^https?:\/\/github\.com\//→/), so only exactgithub.comURLs are normalized. The new pattern matches a strict subset of the old one with identical output where both match; relative/userhrefs (the common case on GitHub pages) are unaffected.Resolves CodeQL alert #1 (
js/regex/missing-regexp-anchor,src/scan.ts:29).Testing
usernameFromHrefcases: absolutegithub.comprofile URLs still resolve;github.com,github.comx,github.com-evil,github.company/...,github.com.evil.io/...return null (github.comxandgithub.com-evilreturned a username before this change).npm run lint,npm test(29/29),npm run buildpass locally.