Repository navigation
[RETIRED via #1314] DOM scalar and identifier hardening - #1396
seonghobae wants to merge 2 commits into
Conversation
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| ["Latest deploy-blocking",Number(latest.deploy_blocking||0)], | ||
| ["New since last scan",Number(latest.new_blocking||0)], | ||
| ["Critical",Number(c.CRITICAL||0)], |
There was a problem hiding this comment.
🔍 Changed rendering paths lack regression coverage
The existing console security test checks only trend-label escaping. It does not exercise the changed count, ID, or badge rendering with unexpected API values.
Was this helpful? React with 👍 or 👎 to provide feedback.
| const s=await api("/api/v1/scans/"+id); | ||
| if(requestId!==currentDetailRequest)return; | ||
| const rows=(s.findings||[]).map(f=>`<tr><td><span class="pill" style="background:${SEV[f.severity]||'var(--info)'}">${esc(f.severity)}</span></td> | ||
| const rows=(s.findings||[]).map(f=>`<tr><td><span class="pill" style="background:${SEV[String(f.severity||'INFO').toUpperCase()]||'var(--info)'}">${esc(f.severity)}</span></td> |
There was a problem hiding this comment.
🟨 Inherited severity keys bypass badge color fallback
When severity becomes an inherited key such as __proto__, SEV returns an object instead of the fallback color. The badge receives an unintended style value from untrusted findings.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
퇴역 근거(보호 브랜치와 동일한 0-diff로 검증 예정):
이제 원래 head를 첫 부모로, 보호 브랜치 |
seonghobae
changed the title
Understood. Acknowledging that this work is now obsolete as the canonical successor (#1314) provides a stricter and better-tested fix. I have reverted all changes to match the base branch to create a 0-diff commit for safe closure. |
1 participant
상태: RETIRED — #1314로 검증된 완전 승계
이 PR은 단순 폐기가 아니라 유효 요구사항을 successor로 완전히 승계한 뒤 source-neutral 커밋으로 퇴역했습니다.
d82e3dfe360abc9dc7f427a168eeb1a08540a6dedevelop@2949d30718752ea5915c7713ba227e8c19d9e5bfahead=2,behind=0, changed files[]a7c934a3f9ca5896b73ad408385e061b4d4e1a5f146cc63da545ee9e8b410edc91a9958205760e13승계 범위
#1314는
safeCount로 음수·소수·Infinity·NaN·비숫자 입력을 fail-closed 처리하고,data-id를 이스케이프하며, 실제 Node 렌더링 회귀 테스트를 제공합니다. #1260은 inherited severity map-key 우회를 제거합니다. 통합 트리 전체 테스트는1095 passed입니다.따라서 review가 지적한 “회귀 테스트 부재”와 “상속된 severity key 우회”를 포함해 이 PR의 유효 보안 delta는 successor에 완전하게 보존됐습니다. 원래 head는 퇴역 커밋의 첫 부모로 보존되어 감사 가능합니다.