mirror of
https://github.com/heygen-com/hyperframes.git
synced 2026-08-31 10:46:57 +00:00
Miguel Ángel
1bcd6ec3b3
Compositions that defer gsap.timeline() registration past DOMContentLoaded (via setTimeout, template instantiation, or dynamic script loading) hit a race where __renderReady stays false forever: 1. At DOMContentLoaded, __hfTimelinesBuilding is false — init.ts skips the hf-timelines-built listener and sets __renderReady = true 2. The deferred script runs, calls gsap.timeline().to() which sets __hfTimelinesBuilding = true via the batching proxy 3. The deferred maybePublishRenderReady() sees building=true, sets __renderReady = false, but never registers a listener to retry 4. __renderReady stays false, __hf.duration returns 0, pollHfReady times out with "Composition has zero duration" Fix: when maybePublishRenderReady encounters __hfTimelinesBuilding=true, register a one-shot hf-timelines-built listener to retry — matching the pattern already used at init time for the synchronous batching case. Closes #1260
65 lines
2.9 KiB
YAML
65 lines
2.9 KiB
YAML
name: "Hyperframes CodeQL config"
|
|
|
|
# Use GitHub's default security-extended suite — it's a strict superset of the
|
|
# default suite (more queries, slightly higher false-positive rate). Pair it with
|
|
# the query-filters below so the extra queries don't drown the dashboard.
|
|
queries:
|
|
- uses: security-extended
|
|
|
|
# Per-rule path filters. The intent is to silence rules that have known false
|
|
# positives on specific file shapes (generated test artifacts, CDN-script test
|
|
# fixtures, functional-cleanup regex) WITHOUT excluding those paths from all
|
|
# analysis — a malicious contributor adding e.g. a command-injection sink into
|
|
# a "test fixture" would still get caught.
|
|
#
|
|
# To audit what changed: look at PR diffs touching this file. Reviewers should
|
|
# treat it like CODEOWNERS — adding a new path exclusion is a policy change.
|
|
query-filters:
|
|
# Generated test artifacts (golden baselines written by the producer test
|
|
# harness). Every compiled.html re-rasterizes the regex-stripped composition;
|
|
# the same alerts fire on every fixture and on every re-render.
|
|
- exclude:
|
|
id: js/incomplete-sanitization
|
|
paths:
|
|
- "packages/producer/tests/**/output/compiled.html"
|
|
- "packages/producer/tests/**/failures/*.html"
|
|
|
|
# Test fixtures and skill test corpora intentionally load CDN scripts without
|
|
# SRI — pinning hashes there would fight the test's purpose (we want the test
|
|
# to use whatever the registry hands back, the same way a composition would).
|
|
- exclude:
|
|
id: js/functionality-from-untrusted-source
|
|
paths:
|
|
- "packages/producer/tests/**"
|
|
- "skills/**/test-corpus/**"
|
|
- "skills/**/assets/test-corpus/**"
|
|
|
|
# The hand-rolled HTML cleanup regex in our build-time tooling looks like a
|
|
# sanitizer to CodeQL but isn't one — it strips framework bootstraps from
|
|
# captured pages before they're fed back into our own renderer (Puppeteer,
|
|
# not a user-facing DOM). Same for the text normalizer in the whisper path
|
|
# (caption text → SRT/VTT, no DOM emission). Scope these exclusions to the
|
|
# exact files that contain functional regex, not to whole directories, so
|
|
# any new code in cli/, core/, or producer/ that LOOKS like a sanitizer
|
|
# still trips the rules.
|
|
- exclude:
|
|
id: js/bad-tag-filter
|
|
paths:
|
|
- "packages/cli/src/capture/index.ts"
|
|
- "packages/cli/src/whisper/normalize.ts"
|
|
- "packages/core/src/lint/utils.ts"
|
|
- "packages/producer/src/services/htmlCompiler.ts"
|
|
- exclude:
|
|
id: js/incomplete-multi-character-sanitization
|
|
paths:
|
|
- "packages/cli/src/capture/index.ts"
|
|
- "packages/cli/src/whisper/normalize.ts"
|
|
|
|
# Golden baselines inline vendor libraries (Three.js, GSAP) whose bundled
|
|
# Math.random() calls trip insecure-randomness. These are test artifacts
|
|
# from compiled compositions, not production code paths.
|
|
- exclude:
|
|
id: js/insecure-randomness
|
|
paths:
|
|
- "packages/producer/tests/**/output/compiled.html"
|