Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion examples/chat-app/src/index.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -257,7 +257,7 @@ function parseBlocks(text: string): Block[] {
}

// ── Handle Paragraphs ────────────────────────
if (line.trim() === '') {
if (line.trim().length === 0) {
blocks.push({
type: 'paragraph',
text: '',
Expand Down
2 changes: 1 addition & 1 deletion examples/rss-reader/src/index.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ function decodeEntities(value: string): string {

return value.replace(/&(#x?[0-9a-fA-F]+|[a-zA-Z]+);/g, (match, entity: string) => {
if (entity.startsWith('#x')) {
const codePoint = Number.parseInt(entity.slice(2), 16);
const codePoint = Number.parseInt(entity.slice(2, 10), 16);
return Number.isFinite(codePoint) ? String.fromCodePoint(codePoint) : match;
Comment on lines +30 to 31

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Locate file:\n'
fd -a 'index\.tsx$' . | sed 's#^\./##' | rg 'rss-reader/src/index\.tsx$|examples/rss-reader/src/index\.tsx$' || true

printf '\nRelevant file excerpt:\n'
sed -n '1,80p' examples/rss-reader/src/index.tsx

printf '\nOccurrences of parseInt/String.fromCodePoint/pattern:\n'
rg -n "number|Number\.parseInt|String\.fromCodePoint|fromCodePoint|\&`#x`|codePoint" examples/rss-reader/src/index.tsx || true

printf '\nJS behavioral probe for reviewed behavior:\n'
node - <<'JS'
const match = '&`#x110000`;';
const used = match.slice(2, 10);
console.log({ full: match, used });
console.log({ parseIntFinite: Number.isFinite(Number.parseInt(used, 16)) });
console.log({ fromCodePointThrows: Object.getOwnPropertyDescriptor(Object.getOwnPropertyDescriptor(Object.getPrototypeOf(String), 'fromCodePoint'), 'length').value });
try {
  String.fromCodePoint(Number.parseInt(used, 16));
  console.log('fromCodePoint did not throw');
} catch (e) {
  console.log({ fromCodePointError: e.message });
}
console.log('0x1FFFF:', Number.parseInt('FFFFFFFF', 16), Number.isFinite(Number.parseInt('FFFFFFFF', 16)));
try {
  String.fromCodePoint(0xFFFFFFFF);
} catch (e) {
  console.log('0xFFFFFFFF error:', e.message);
}
JS

Repository: Karanjot786/TermUI

Length of output: 4149


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Locate file:\n'
fd -a 'index\.tsx$' . | sed 's#^\./##' | rg 'rss-reader/src/index\.tsx$|examples/rss-reader/src/index\.tsx$' || true

printf '\nRelevant file excerpt:\n'
sed -n '1,80p' examples/rss-reader/src/index.tsx

printf '\nOccurrences of parseInt/String.fromCodePoint/pattern:\n'
rg -n "number|Number\.parseInt|String\.fromCodePoint|fromCodePoint|\&`#x`|codePoint" examples/rss-reader/src/index.tsx || true

printf '\nJS behavioral probe for reviewed behavior:\n'
node - <<'JS'
const match = '&`#x110000`;';
const used = match.slice(2, 10);
console.log({ full: match, used });
console.log({ parseIntFinite: Number.isFinite(Number.parseInt(used, 16)) });
try {
  String.fromCodePoint(Number.parseInt(used, 16));
  console.log('fromCodePoint did not throw');
} catch (e) {
  console.log({ fromCodePointError: e.message });
}
console.log('0x1FFFF:', Number.parseInt('FFFFFFFF', 16), Number.isFinite(Number.parseInt('FFFFFFFF', 16)));
try {
  String.fromCodePoint(0xFFFFFFFF);
} catch (e) {
  console.log('0xFFFFFFFF error:', e.message);
}
JS

Repository: Karanjot786/TermUI

Length of output: 3475


Reject hexadecimal entities that exceed eight digits or the Unicode code-point limit.

entity.slice(2, 10) includes characters after the hex digits and ignores the full matched entity length. Malformed entities such as &#x110000; do not pass Number.isFinite, but entities longer than eight hex digits can be decoded as truncated values, and non-surrogate values above 0xFFFF below 0x10FFFF are also valid characters.

Extract the actual hex digits from the matched entity, return match when that sequence exceeds eight digits, parse the full sequence, and return match when the parsed value exceeds 0x10FFFF.

Proposed fix
-      const codePoint = Number.parseInt(entity.slice(2, 10), 16);
-      return Number.isFinite(codePoint) ? String.fromCodePoint(codePoint) : match;
+      const digits = entity.slice(2, -1);
+      if (digits.length > 8) return match;
+      const codePoint = Number.parseInt(digits, 16);
+      return Number.isFinite(codePoint) && codePoint <= 0x10FFFF
+        ? String.fromCodePoint(codePoint)
+        : match;
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
const codePoint = Number.parseInt(entity.slice(2, 10), 16);
return Number.isFinite(codePoint) ? String.fromCodePoint(codePoint) : match;
const digits = entity.slice(2, -1);
if (digits.length > 8) return match;
const codePoint = Number.parseInt(digits, 16);
return Number.isFinite(codePoint) && codePoint <= 0x10FFFF
? String.fromCodePoint(codePoint)
: match;
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@examples/rss-reader/src/index.tsx` around lines 30 - 31, Update the
entity-decoding logic around codePoint to extract the complete hexadecimal digit
sequence from entity rather than slicing a fixed range. Reject and return match
when the sequence exceeds eight digits, parse the full sequence, and also reject
values above 0x10FFFF; otherwise preserve the existing String.fromCodePoint
conversion.

}

Expand Down
2 changes: 2 additions & 0 deletions packages/ui/src/Form.ts
Original file line number Diff line number Diff line change
Expand Up @@ -138,3 +138,5 @@ export class Form extends Widget {
}
}
}

.catch(err => console.error("Promise.all failed:", err));
Comment on lines +141 to +142

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '75,145p' packages/ui/src/Form.ts

if rg -n '^\s*\.catch\s*\(' packages/ui/src/Form.ts; then
  echo "Found a standalone catch chain."
  exit 1
fi

if ! rg -n 'Promise\.all\(validationPromises\).*\.catch|try\s*\{' packages/ui/src/Form.ts; then
  echo "No valid rejection-handling construct found."
  exit 1
fi

Repository: Karanjot786/TermUI

Length of output: 3039


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Form.ts outline =="
ast-grep outline packages/ui/src/Form.ts || true

echo "== Full Form.ts catch/block context =="
sed -n '1,180p' packages/ui/src/Form.ts

echo "== Standalone catch parse probe =="
node - <<'JS'
const source = `
class X { async m() { await 1; } }
Promise.all([1]).catch(e => console.log(e))
`;
try {
  const f = new Function(source);
  console.log("Node parsed source successfully");
  f();
} catch (err) {
  console.log("Parse/runtime error:", err.message);
}
JS

Repository: Karanjot786/TermUI

Length of output: 7382


Remove the orphaned Promise.all(...).catch(...) outside the class.

This .catch appears after the closing class Form }, not on the Promise.all(...) expression, so packages/ui/src/Form.ts fails to parse. Move the rejection handling into the submit() method where validation runs, or remove the dead handler entirely.

🧰 Tools
🪛 Biome (2.5.6)

[error] 142-142: Expected a statement but instead found '.catch(err => console.error("Promise.all failed:", err))'.

(parse)

🪛 GitHub Actions: CI / 0_build-and-test.txt

[error] 142-142: @termuijs/ui build failed during tsup/esbuild. Unexpected '.' in standalone '.catch(err => console.error("Promise.all failed:", err));', causing TypeScript syntax errors (TS1128, TS1005, TS2304). Command failed: bun run build (exit code 1).

🪛 GitHub Actions: CI / build-and-test

[error] 142-142: @termuijs/ui build (tsup/esbuild) failed: Unexpected "." at the leading .catch(...) expression. TypeScript also reports TS1128, TS1005, and TS2304 syntax errors. Command: bun run build.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/ui/src/Form.ts` around lines 141 - 142, Remove the orphaned catch
handler after the Form class and ensure Promise.all rejection handling is
attached within the submit() method’s validation flow, or remove it if unused,
so Form.ts parses correctly.

Source: Linters/SAST tools

2 changes: 1 addition & 1 deletion packages/ui/src/Switch.ts
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ export class Switch extends Widget {
if (width <= 0) return;

const attrs = styleToCellAttrs(this.style);
const knobPos = Math.round(this._animProgress * 2);
const knobPos = Math.round(this._animProgress * 2 + Number.EPSILON);
const transitioning = this._animProgress > 0 && this._animProgress < 1;

let trackChars: string[];
Expand Down
Loading