Skip to content

Potential fix for code scanning alert no. 11: Incomplete multi-character sanitization #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
EthanThePhoenix38 merged 1 commit into from
Jan 8, 2026
Merged

Potential fix for code scanning alert no. 11: Incomplete multi-character sanitization #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
"dompurify": "^3.3.1",
"express": "^5.2.1",
"isomorphic-dompurify": "^2.35.0",
"rss-parser": "^3.13.0"
"rss-parser": "^3.13.0",
"sanitize-html": "^2.17.0"
Comment on lines +10 to +11
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update lockfile for new sanitize-html dependency

This commit adds sanitize-html to package.json but does not update package-lock.json. In any environment that installs dependencies via the lockfile (e.g., npm ci in CI/CD or deployments), sanitize-html will not be installed and the new require('sanitize-html') in src/aggregator.js will throw MODULE_NOT_FOUND at runtime. Please regenerate the lockfile so it includes the new dependency.

Useful? React with 👍 / 👎.

Comment on lines +10 to +11
Copy link

Copilot AI Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The project already includes dompurify and isomorphic-dompurify as dependencies. Adding sanitize-html creates redundancy with three different HTML sanitization libraries. Consider using one of the existing libraries (particularly isomorphic-dompurify which works in both browser and Node.js environments) instead of introducing a third sanitization library. This would reduce bundle size, dependency complexity, and potential security surface.

Suggested change
"rss-parser": "^3.13.0",
"sanitize-html": "^2.17.0"
"rss-parser": "^3.13.0"

Copilot uses AI. Check for mistakes.
}
}
16 changes: 14 additions & 2 deletions src/aggregator.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
const Parser = require('rss-parser');
const axios = require('axios');
const { Octokit } = require('@octokit/rest');
const sanitizeHtml = require('sanitize-html');
Copy link

Copilot AI Jan 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider using the existing isomorphic-dompurify library instead of adding sanitize-html. The project already has DOMPurify available, which can strip HTML tags effectively using DOMPurify.sanitize(input, {ALLOWED_TAGS: []}). This would maintain consistency with the sanitization approach used in the HTML files (portfolio.html, reader.html, stats.html) and reduce the number of dependencies.

Copilot uses AI. Check for mistakes.

const parser = new Parser({
timeout: 10000,
Expand All @@ -28,6 +29,17 @@ function addUTMParams(url, category = 'general') {
return url.includes('?') ? `${url}&${utmParams}` : `${url}?${utmParams}`;
}

// Robust HTML sanitization: strip all tags and unsafe content
function sanitizeText(input) {
if (!input) {
return '';
}
return sanitizeHtml(input, {
allowedTags: [],
allowedAttributes: {},
});
}

/**
* Smart truncate: cut at last punctuation before limit
* Avoids cutting words in the middle
Expand Down Expand Up @@ -65,10 +77,10 @@ function smartTruncate(text, maxLength = 500) {

// Sanitize and process articles
function sanitizeArticle(article, sourceName, tags, category) {
const rawSummary = article.contentSnippet?.replace(/<[^>]*>/g, '') || '';
const rawSummary = sanitizeText(article.contentSnippet) || '';

return {
title: article.title?.replace(/<[^>]*>/g, '').slice(0, 200) || 'Untitled',
title: (sanitizeText(article.title) || 'Untitled').slice(0, 200),
link: addUTMParams(article.link, category), // UTM tracks traffic FROM AI-Pulse
pubDate: new Date(article.pubDate || Date.now()),
source: sourceName,
Expand Down
Loading