fix: formatting normalization, DOM API XSS fixes, script robustness#60
Open
fix: formatting normalization, DOM API XSS fixes, script robustness#60
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…d param with underscore
…ode-scanning flags
Fail-Safe
changed the title
…UDE.md - fix(release-bump): apply sanitizedInner to changelog insertion (was computed but unused) - fix(release-bump): refactor to export sanitizeChangelogInner for unit testing and guard direct execution via import.meta.url - fix(update-plan-data): replace regex-based HTML parsing with node-html-parser for robustness; add node-html-parser to devDependencies - fix(extension): validate URI scheme via Uri.parse in openExternal handler instead of string prefix check - fix(extension): use md.appendText for error string in status bar tooltip to prevent markdown injection - fix(sidebarProvider): rewrite trend direction innerHTML assignments to DOM API to prevent XSS; wrap updateView in try/catch with fallback postMessage - fix(webview): rewrite renderSummary and renderMultiMonthAnalysis to use DOM API instead of innerHTML template literals - fix(.gitignore): add codeql-results*.sarif pattern - chore(tsconfig): include src/**/*.d.ts so test type declarations are picked up by tsc - chore(tests): add type declaration files for mjs scripts; add unit tests for update-plan-data and release-bump sanitizer - docs: add CLAUDE.md with build commands, architecture overview, and test structure Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…d test runs startAutoRefresh() fires an unconditional immediate performAutoRefresh() when restartAutoRefresh() is called from the refreshIntervalMinutes config change handler. This raced with lastAttemptGate.test.ts setting its own timestamps even though CPUM_TEST_DISABLE_TIMERS=1 was set (that guard only covered the initial activation path). Suppress the eager refresh when CPUM_TEST_DISABLE_TIMERS is active; restart-count increments are unaffected. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The test hardcoded oneIntervalMs = 5 * 60_000 but _test_getAttemptMeta() reads refreshIntervalMinutes live from config at assertion time. If the setting hasn't propagated fully (write race or prior test state), the computed intervalMs would be larger (e.g. 15 min = 900000 ms) and the 620 s time delta would fail both gating conditions. Fix: wait 100 ms after the config change to let any triggered background ops settle, then read the effective interval back from config to derive all timestamp offsets — ensuring the test's math is always consistent with what _test_getAttemptMeta will compute. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fail-Safe
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
normalizeUsageQuantity()utility prevents floating-point artifacts (e.g.406.59000000000003) from leaking into UI and persisted state; applied throughout billing calculations inextension.ts,viewModel.ts, andusageUtils.tsrenderSummaryandrenderMultiMonthAnalysisinwebview.jsrewritten from innerHTML template literals to DOM API;sidebarProvider.tstrend direction assignments likewise; status bar tooltip usesmd.appendTextinstead of string interpolation;openExternalvalidates scheme viaUri.parserelease-bump.mjsnow appliessanitizeChangelogInnerto the actual changelog insertion (was computed but unused); refactored for unit-testability viaimport.meta.urlguard;update-plan-data.mjsreplaces fragile regex HTML parsing withnode-html-parserformatYAxisValuewith locale-aware decimal precisionupdate-plan-datatable parsing andrelease-bumpsanitizer; type declaration files for.mjsscript importsCLAUDE.mdwith build commands, architecture overview, and test structureTest plan
npm run test:unit— 26/26 passnpm test— full suite including VS Code Extension Host integration tests🤖 Generated with Claude Code