morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1295] [MERGED] fix(javascript): reject encoded separators joined by HTML URL whitespace #2775

New issue

Closed

opened 2026-10-17 21:10:07 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:10:07 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1295
Author: @kaoru0822-kitauji
Created: 10/9/2026
Status: ✅ Merged
Merged: 10/9/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/javascript-html-url-whitespace-admission

📝 Commits (1)

fb57c86 fix(javascript): reject encoded separators joined by HTML URL whitespace

📊 Changes

2 files changed (+13 additions, -1 deletions)

View changed files

📝 src/application/javascript/JavaScriptArtifactPathResolution.ts (+6 -0)
📝 src/application/javascript/JavaScriptHtmlBaseResolution.test.ts (+7 -1)

📄 Description

Summary

Follow-up to #1287, which merged before this review finding was addressed.

#1287 reads an HTML script URL the way the URL parser does, removing embedded tabs and newlines before percent-decoding. The raw declaration was admitted (admitsCanonicalPathSyntax) before that normalization. So a declaration that splits an encoded dot or separator with URL whitespace passed admission, became %2f / %2e%2e after normalization, and was then decoded:

src="%2\nfapp.js"              -> resolved "app.js"          (on main)
src="%2\ne%2\ne/sibling/app.js" -> resolved "sibling/app.js"  (on main)

The documented contract is that encoded dot and separator bytes are rejected. The base href path was already checked after normalization; only the script URL was affected. The Codex review on #1287 flagged this (JavaScriptArtifactPathResolution.ts:253, "Revalidate normalized HTML script paths").

Change

Run admitsCanonicalPathSyntax again on the parsed script URL text, before percent-decoding, with the same rejected limitation as the raw check.

Verification

src/application/javascript/JavaScriptHtmlBaseResolution.test.ts: %2\nfapp.js and %2\ne%2\te/app.js are now rejected; both fail on main. A base href split the same way (a%2\nf/) is pinned as rejected.
npm run check:changed
npm run test:focused -- tests/boundary/filesystem/javascriptHtmlResourcePaths.test.ts

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1295 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/9/2026 **Status:** ✅ Merged **Merged:** 10/9/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/javascript-html-url-whitespace-admission` --- ### 📝 Commits (1) - [`fb57c86`](https://github.com/morluto/rea/commit/fb57c8643fb8b4733cbac9090ef58fd13a3b5347) fix(javascript): reject encoded separators joined by HTML URL whitespace ### 📊 Changes **2 files changed** (+13 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/application/javascript/JavaScriptArtifactPathResolution.ts` (+6 -0) 📝 `src/application/javascript/JavaScriptHtmlBaseResolution.test.ts` (+7 -1) </details> ### 📄 Description ## Summary Follow-up to #1287, which merged before this review finding was addressed. #1287 reads an HTML script URL the way the URL parser does, removing embedded tabs and newlines before percent-decoding. The raw declaration was admitted (`admitsCanonicalPathSyntax`) before that normalization. So a declaration that splits an encoded dot or separator with URL whitespace passed admission, became `%2f` / `%2e%2e` after normalization, and was then decoded: ``` src="%2\nfapp.js" -> resolved "app.js" (on main) src="%2\ne%2\ne/sibling/app.js" -> resolved "sibling/app.js" (on main) ``` The documented contract is that encoded dot and separator bytes are rejected. The base href path was already checked after normalization; only the script URL was affected. The Codex review on #1287 flagged this (`JavaScriptArtifactPathResolution.ts:253`, "Revalidate normalized HTML script paths"). ## Change Run `admitsCanonicalPathSyntax` again on the parsed script URL text, before percent-decoding, with the same `rejected` limitation as the raw check. ## Verification - `src/application/javascript/JavaScriptHtmlBaseResolution.test.ts`: `%2\nfapp.js` and `%2\ne%2\te/app.js` are now `rejected`; both fail on `main`. A base href split the same way (`a%2\nf/`) is pinned as rejected. - `npm run check:changed` - `npm run test:focused -- tests/boundary/filesystem/javascriptHtmlResourcePaths.test.ts` 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:10:07 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:06:13 +00:00

[PR #2775] [MERGED] fix(sqlite): classify a missing database path as an invalid value #5384

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2775

No description provided.

Rows
Columns