mirror of
https://github.com/actions/setup-java.git
synced 2026-08-02 00:11:50 +08:00
ff11496cf1
Patch is-unsafe's XML comment-close detector during builds so generated bundles recognize both HTML comment end forms and satisfy CodeQL until the dependency publishes a fix. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 277302b1-aa95-4012-817b-9752cdaee14e
21 lines
719 B
JavaScript
21 lines
719 B
JavaScript
import {readFile, writeFile} from 'node:fs/promises';
|
|
|
|
const sourcePath = new URL('../node_modules/is-unsafe/src/contexts/xml.js', import.meta.url);
|
|
const vulnerablePattern = 'pattern: /-->/,';
|
|
const safePattern = 'pattern: /--!?>/,';
|
|
const source = await readFile(sourcePath, 'utf8');
|
|
|
|
// CodeQL treats this XML detector as an incomplete HTML comment-end filter.
|
|
if (source.includes(safePattern)) {
|
|
process.exit(0);
|
|
}
|
|
|
|
const occurrences = source.split(vulnerablePattern).length - 1;
|
|
if (occurrences !== 1) {
|
|
throw new Error(
|
|
`Expected one ${JSON.stringify(vulnerablePattern)} in ${sourcePath.pathname}, found ${occurrences}`
|
|
);
|
|
}
|
|
|
|
await writeFile(sourcePath, source.replace(vulnerablePattern, safePattern));
|