Conversation
Fixed issues with the strikes page (my-strikes.html): 1. Corrected HTML structure with properly closed tags 2. Fixed JavaScript errors in parameter handling 3. Moved jQuery script to proper location 4. Fixed incorrect content references in dynamic section logic 5. Improved code formatting and fixed typos Closes # 69
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
| } | ||
| </style> | ||
| <script src="//code.jquery.com/jquery-1.12.0.min.js"></script> |
Check warning
Code scanning / CodeQL
Inclusion of functionality from an untrusted source Medium
| // Parse the URL parameter | ||
| function getParameterByName(name, url) { | ||
| if (!url) url = window.location.href; | ||
| name = name.replace(/[\[\]]/g, "\\$&"); |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the issue, we need to ensure that backslashes in the name parameter are properly escaped before constructing the regular expression. This can be achieved by adding an additional replace call to escape backslashes (\) in the input string. Specifically:
- Add a
replacecall to escape backslashes before escaping square brackets. - Use a well-tested approach to escape backslashes by replacing each backslash with a double backslash (
\\).
The updated code will ensure that both backslashes and square brackets are properly escaped, making the function robust against malformed or insecure regular expressions.
| @@ -174,3 +174,3 @@ | ||
| if (!url) url = window.location.href; | ||
| name = name.replace(/[\[\]]/g, "\\$&"); | ||
| name = name.replace(/\\/g, "\\\\").replace(/[\[\]]/g, "\\$&"); | ||
| var regex = new RegExp("[?&]" + name + "(=([^&#]*)|&|#|$)"), |
|
Thank you for reviewing and merging these changes! The fixes should resolve the JavaScript errors and address the security issues that were identified during code scanning. The strikes page should now properly:
Let me know if you encounter any other issues with the page. |
2 participants
Fixed issues with the strikes page (my-strikes.html):
Closes #69
🤖 See my steps and cost here ✨