Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: limit overly permissive regex range #949

Merged
merged 2 commits into from
Nov 14, 2024
Merged

fix: limit overly permissive regex range #949

merged 2 commits into from
Nov 14, 2024

Conversation

barmac
Copy link
Member

@barmac barmac commented Nov 12, 2024

Proposed Changes

This fragment of code deals with letters so it should not match additional characters.

Checklist

To ensure you provided everything we need to look at your PR:

  • Brief textual description of the changes present
  • Visual demo attached
  • Steps to try out present, i.e. using the @bpmn-io/sr tool
  • Related issue linked via Closes {LINK_TO_ISSUE} or Related to {LINK_TO_ISSUE}

@barmac
fix: limit overly permissive regex range
18781c9 
This fragment of code deals with letters so it should not
match additional characters.
@bpmn-io-tasks bpmn-io-tasks bot added the in progress Currently worked on label Nov 12, 2024
@barmac
Copy link
Member Author

barmac commented Nov 12, 2024

I'll check if it's not breaking bpmn-js, but should be safe to merge.

barmac added a commit to bpmn-io/bpmn-js that referenced this pull request Nov 13, 2024
@barmac
TO_REMOVE: install diagram-js from commit
5df86bd 
Related to bpmn-io/diagram-js#949
@barmac
Copy link
Member Author

barmac commented Nov 13, 2024

Testing on bpmn-js via https://github.com/bpmn-io/bpmn-js/actions/runs/11815595868

@barmac
Copy link
Member Author

barmac commented Nov 13, 2024

I had to skip types test as they are apparently not generated for install from commit. This is the new run: https://github.com/bpmn-io/bpmn-js/actions/runs/11815660568

@barmac
Copy link
Member Author

barmac commented Nov 13, 2024

A manual smoke test did not reveal any issues.

@barmac barmac marked this pull request as ready for review November 13, 2024 10:47
@bpmn-io-tasks bpmn-io-tasks bot added needs review Review pending and removed in progress Currently worked on labels Nov 13, 2024
@nikku nikku requested a review from misiekhardcore November 14, 2024 08:50
nikku
nikku reviewed Nov 14, 2024
View reviewed changes
Copy link
Member

@nikku nikku left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I propose we add a dedcated test case for this, i.e. verify our replace strategy. Not 100% sold on whether this is actually a bug worth fixing.

For this to ever be an issue we'd need to get elements from untrusted input.

@barmac
Copy link
Member Author

barmac commented Nov 14, 2024

I'll add a test case for this util.

@barmac
Copy link
Member Author

barmac commented Nov 14, 2024

Test cases added via 06db3c7

@barmac barmac requested a review from nikku November 14, 2024 12:26
nikku
nikku approved these changes Nov 14, 2024
View reviewed changes
Copy link
Member

@nikku nikku left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good one, thanks!

@barmac barmac merged commit a55b7f9 into main Nov 14, 2024
12 checks passed
@bpmn-io-tasks bpmn-io-tasks bot removed the needs review Review pending label Nov 14, 2024
@barmac barmac deleted the barmac-patch-1 branch November 14, 2024 13:16
@ElRaptorus ElRaptorus mentioned this pull request Jan 9, 2025
Merged
ElRaptorus added a commit to 5minds/diagram-js that referenced this pull request Feb 4, 2025
@ElRaptorus
Bump to 15.2.4 (#6)
4c383e9 
# Changes 

Siehe Changelog:
https://github.com/bpmn-io/diagram-js/blob/develop/CHANGELOG.md

## 15.2.4

* `FIX`: canvas `autoFocus` must explicitly be enabled
([bpmn-io#956](bpmn-io#956))
* `FIX`: properly integrate `zoomscroll` with canvas focus
([bpmn-io#956](bpmn-io#956))
* `FIX`: properly integrate `movecanvas` with canvas focus
([bpmn-io#956](bpmn-io#956))

## 15.2.3

* `FIX`: adjust search to prioritize start of word and exact matches
([bpmn-io#953](bpmn-io#953))
* `FIX`: ignore whitespace when searching
([bpmn-io#954](bpmn-io#954))

## 15.2.2

* `FIX`: correct `Keyboard#bind` and config types
([bpmn-io#948](bpmn-io#948))

## 15.2.1

* `FIX`: limit overly permissive regex
([bpmn-io#949](bpmn-io#949))

## 15.2.0

* `FIX`: clear selection when opening search pad
([bpmn-io#947](bpmn-io#947))
* `FIX`: correct dangling selection after search pad interaction
([bpmn-io#947](bpmn-io#947))
* `CHORE`: simplify search pad pre-selection behavior
([bpmn-io#947](bpmn-io#947))

## 15.1.0

* `FEAT`: integrate `popup-menu` with `search`
([bpmn-io#932](bpmn-io#932))
* `FEAT`: recognize modern `search` tokens in `search-pad`
([bpmn-io#932](bpmn-io#932))
* `FEAT`: improve `search` types
([bpmn-io#932](bpmn-io#932))
* `FIX`: correctly handle duplicate entries and whitespace in `search`
([bpmn-io#932](bpmn-io#932))
* `FIX`: find `search` terms across all keys
([bpmn-io#932](bpmn-io#932))
* `FIX`: `search` always returns tokens for matched items
([bpmn-io#932](bpmn-io#932))

## 15.0.0

* `FEAT`: make canvas browser selectable
([bpmn-io#659](bpmn-io#659))
* `FEAT`: make keyboard binding implicit
([bpmn-io#661](bpmn-io#661))
* `FEAT`: make multi-selection outline an outline concern
([bpmn-io#944](bpmn-io#944))

### Breaking Changes

* `Keyboard` binding target can no longer be chosen. Configure keyboard
binding via the `keyboard.bind` configuration and rely on keybindings to
work if the canvas has browser focus.
([bpmn-io#661](bpmn-io#661))
* The `Canvas` is now a focusable component, that is recognized
accordingly by the browser, with all benefits for UX and interaction.
Components that pull focus from the `Canvas` during modeling must ensure
to restore the focus (if intended), via `Canvas#restoreFocus`.
([bpmn-io#661](bpmn-io#661))
* The `selection` feature does not provide visual outline by default
anymore. Use the `outline` feature to re-enable it.
([bpmn-io#944](bpmn-io#944))

## 14.11.3

* `CHORE`: simplify viewbox cloning
([bpmn-io#935](bpmn-io#935))

## 14.11.2

* `FIX`: restore search result highlight
([bpmn-io#931](bpmn-io#931))
* `FIX`: correct search result highlight not being removed
([bpmn-io#931](bpmn-io#931))
* `FIX`: do not change zoom when search openes
([bpmn-io#931](bpmn-io#931))

## 14.11.1

_Partially reverts v14.11.0._

* `FIX`: revert `search` integration into popup menu

## 14.11.0

* `FEAT`: add `search` utility
* `FEAT`: sort popup entry search results semantically
([bpmn-io#916](bpmn-io#916))

## 14.10.0

* `FEAT`: align search styling with other popups
([bpmn-io#913](bpmn-io#913))
* `CHORE`: use existing outline in search
([bpmn-io#913](bpmn-io#913))
* `FIX`: only commit search viewport changes on `ENTER`
([bpmn-io#913](bpmn-io#913))

## 14.9.0

* `CHORE`: export types compatible with `verbatimModuleSyntax`
([bpmn-io#927](bpmn-io#927),
[bpmn-io#864](bpmn-io#864))
* `CHORE`: re-compute context pad position next frame
([bpmn-io#920](bpmn-io#920))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nikku nikku nikku approved these changes

@philippfromme philippfromme Awaiting requested review from philippfromme

@misiekhardcore misiekhardcore Awaiting requested review from misiekhardcore

Assignees

@barmac barmac

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@barmac @nikku