ext/hyperframes
2
0
Fork 0
mirror of https://github.com/heygen-com/hyperframes.git synced 2026-09-03 04:38:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(bundler): parse scripts via linkedom, not regex

Browse Source 
Per CodeQL's `js/bad-tag-filter` recommendation, replace the regex-based
`<script>` body extraction with a `parseHTML` + `querySelectorAll`
walk. The rule explicitly says "use a parser library" — and linkedom
is already imported in this file, so the diff is small.

This eliminates the regex entirely, so the rule can no longer fire on
this site (instead of chasing whitespace / case / trailing-content
edge cases one at a time).
This commit is contained in:
James
2026-05-06 05:06:42 +00:00
parent f3f542b42f
commit 3d370c4064
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/core/src/compiler/htmlBundler.test.ts
+5 -5
View File
@@ -105,12 +105,12 @@ describe("bundleToSingleHtml", () => {
const bundled = await bundleToSingleHtml(dir); const bundled = await bundleToSingleHtml(dir);
// Run every inline script body through esbuild; if the line comment ate // Run every inline script body through esbuild; if the line comment ate
// the separator, parse would fail with an unexpected-token error somewhere // the separator, parse would fail with an unexpected-token error somewhere
// around the chunk boundary. // around the chunk boundary. Use a real HTML parser (CodeQL flags regex-
// based script extraction as bad-tag-filter).
const { transformSync } = await import("esbuild"); const { transformSync } = await import("esbuild");
const re = /<script\b[^>]*>([\s\S]*?)<\/script[^>]*>/gi; const { document } = parseHTML(bundled);
let m: RegExpExecArray | null; for (const script of document.querySelectorAll("script")) {
while ((m = re.exec(bundled)) !== null) { const body = script.textContent;
const body = m[1];
if (!body || !body.trim()) continue; if (!body || !body.trim()) continue;
expect(() => transformSync(body, { loader: "js", minify: false })).not.toThrow(); expect(() => transformSync(body, { loader: "js", minify: false })).not.toThrow();
} }