Strip markdown comments from stringified commits #528
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -79,3 +81,7 @@ | |||
| .replaceAll('{{{{/raw}}}}', ''); | |||
| } | |||
| } | |||
|
|
|||
| function stripMarkdownComments(str: string): string { | |||
| return str.replace(/<!--[\s\S]*?-->/g, ''); | |||
Check failure
Code scanning / CodeQL
Incomplete multi-character sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 14 days ago
To fix the problem, we need to ensure that all instances of the targeted pattern are removed, even if they appear consecutively or are nested. One effective way to achieve this is to apply the regular expression replacement repeatedly until no more replacements can be performed. This ensures that the unsafe text does not reappear in the sanitized input.
We will modify the stripMarkdownComments function to repeatedly apply the regular expression replacement until the input string no longer changes. This will ensure that all HTML comments are fully removed.
| @@ -85,3 +85,8 @@ | ||
| function stripMarkdownComments(str: string): string { | ||
| return str.replace(/<!--[\s\S]*?-->/g, ''); | ||
| let previous; | ||
| do { | ||
| previous = str; | ||
| str = str.replace(/<!--[\s\S]*?-->/g, ''); | ||
| } while (str !== previous); | ||
| return str; | ||
| } |
Follow up to #526
This strips markdown comments like
<!-- markdown-comment -->in the stringified commit message{{commitsStringified}}