fix: resolve remaining CodeQL code-scanning alerts - #167
Conversation
Addresses the open CodeQL code-scanning findings: - Inclusion of functionality from an untrusted source (docs/layouts/partials/footer_js.html): the highlight.js bundle was loaded from a CDN over a hardcoded URL with no integrity check. Add a Subresource Integrity (SRI) hash and crossorigin attribute, and move to the maintained highlight.js v11.11.1 build. The integrity hash is derived from the official @highlightjs/cdn-assets npm artifact, which jsdelivr serves byte-for-byte, so the hash is guaranteed to match. v11 replaces the removed initHighlightingOnLoad() with highlightAll(). - Incorrect suffix check (js/shared.js): endsWith() computed s.substring(s.length - search.length) without guarding against a search string longer than s (a negative start index). Add an explicit search.length <= s.length guard. Kept the manual implementation because this file is embedded and evaluated in the ES5 otto runtime, which lacks String.prototype.endsWith. The two client-side XSS findings in docs/static/js/search.js were already resolved on main (replaceWith -> text); all findings will auto-close on the next CodeQL scan. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GAXAPgXCc5TpEeZiFbwkhf
github-actions
Bot
added
the
documentation
BenchstatBase: 2 minor regression(s) (all within 5% threshold)
1 improvement(s)
Full benchstat output |
|
Warning Review limit reached
Next review available in: 27 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
2 participants
Summary
Resolves the open CodeQL code-scanning alerts:
docs/layouts/partials/footer_js.html:88crossoriginto the highlight.js scriptjs/shared.js:40endsWithagainst an over-long suffixdocs/static/js/search.js:25,35main(see below)Details
Inclusion of functionality from an untrusted source —
footer_js.htmlThe highlight.js bundle was loaded from a hardcoded CDN URL with no integrity check, so a compromised/hijacked CDN response would execute arbitrary script on the docs site. Added a Subresource Integrity hash and
crossorigin="anonymous", and moved to the maintained highlight.js v11.11.1 build.@highlightjs/cdn-assets@11.11.1npm artifact, which jsdelivr serves byte-for-byte — so theintegrityvalue is guaranteed to match what browsers fetch.initHighlightingOnLoad(); replaced withhljs.highlightAll().Incorrect suffix check —
js/shared.jsendsWith()computeds.substring(s.length - search.length)without checking thatsearchisn't longer thans. When it is, the start index is negative,substringclamps it to0, and the check reduces tos === search— the error-prone pattern CodeQL flags. Added an explicitsearch.length <= s.lengthguard.The manual implementation is kept intentionally:
shared.jsis embedded and evaluated in the ES5 otto runtime, which has no nativeString.prototype.endsWith. Behavior is unchanged for all valid inputs (verified against a set of cases).Client-side cross-site scripting —
search.jsThese two alerts were already resolved on
mainin #165, which switched the reflected search query from$(...).replaceWith(searchQuery)(an HTML sink) to$(...).text(searchQuery)(text, not HTML). No further change is needed; they will auto-close on the next scan.Verification
go build ./...andgo vet ./js/...pass (the embeddedshared.jsis valid ES5).endsWithbehavior validated against edge cases (suffix longer than string, empty strings, exact match).Note (not in scope of these alerts)
docs/config.tomlalso loadsfuse.jsandmark.jsfrom cdnjs without SRI. CodeQL does not flag those because they reach the template through a variable ({{ . | absURL }}) rather than a literal URL, but they're the same class of issue and could be given SRI in a follow-up.🤖 Generated with Claude Code
https://claude.ai/code/session_01GAXAPgXCc5TpEeZiFbwkhf
Generated by Claude Code