feat: Dual Mode #129
feat: Dual Mode #129
Conversation
…, and unsupported pane type
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
…parameter handling
… combobox elements
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
| } else { | ||
| // For primitives, directly assign the source value | ||
| target[key] = source[key]; |
Check warning
Code scanning / CodeQL
Prototype-polluting function Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 2 months ago
To fix the prototype pollution issue in the deepMerge function, we need to add checks to block the __proto__ and constructor properties from being merged. This will prevent any malicious properties from being copied to the target object and potentially polluting the prototype.
- Modify the
deepMergefunction to include checks that skip the__proto__andconstructorproperties. - Ensure that these checks are applied before any recursive merging or direct assignment of properties.
| @@ -128,2 +128,4 @@ | ||
| if (source.hasOwnProperty(key)) { | ||
| // Skip prototype pollution properties | ||
| if (key === "__proto__" || key === "constructor") continue; | ||
| // Check if the current key's value is an object and exists in the target |
| const highlightedText = highlightMatches(text, query); | ||
|
|
||
| if (query === "" || highlightedText !== text) { | ||
| item.innerHTML = highlightedText; |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 2 months ago
To fix the problem, we need to ensure that any text derived from the data-label attribute is properly escaped before being assigned to item.innerHTML. This can be achieved by using a function that escapes HTML special characters, converting them to their corresponding HTML entities. This way, any potentially malicious content will be rendered as plain text rather than executable HTML.
We will create a utility function escapeHtml to escape the HTML special characters and use this function to sanitize the highlightedText before assigning it to item.innerHTML.
| @@ -501,2 +501,11 @@ | ||
|
|
||
| function escapeHtml(unsafe: string): string { | ||
| return unsafe | ||
| .replace(/&/g, "&") | ||
| .replace(/</g, "<") | ||
| .replace(/>/g, ">") | ||
| .replace(/"/g, """) | ||
| .replace(/'/g, "'"); | ||
| } | ||
|
|
||
| function showDropdown() { | ||
| @@ -511,3 +520,3 @@ | ||
| if (query === "" || highlightedText !== text) { | ||
| item.innerHTML = highlightedText; | ||
| item.innerHTML = escapeHtml(highlightedText); | ||
| if (visibleCount < maxVisibleOptions) { |
Fixes #3