mirror of
https://github.com/Twigpine/openlaunch.git
synced 2026-11-13 06:51:24 -10:00
Kevin Codex
f2a5c065ba
From the third CodeRabbit review of #88, and from reviewing those fixes. - new-host: a scheme with no host after it ("https://" + target) had no finding. It is "(computed)" now, as a template placeholder already was. So are an empty host ("https://@" + x), an address that ends its string and has more joined on ("https://known.org" + ".elsewhere.io"), and "//" + host. Also read: a host behind escaped slashes, an address with no scheme, a wildcard host. The base branch's hosts are read with the same rule. Not seen, on purpose: a scheme that is itself split ("https:" + "//" + host). A string that is only "https:" is how the app compares protocols, in eleven places. - dangerous-code: the same things spelled another way. Function() without new, eval reached indirectly, a timer given its code as a string, createElement("script"), and the environment taken as one object ({ KEY } = process.env, env: process.env). - auth-removed: a deleted file takes its checks with it, and that was never reported, since a deleted file is not read. Now it is, unless the same check turns up again in what the pull request adds (a move). - check-deployed-sources.sh: --update refuses a file git does not track, writes each path as git spells it from the root (the guard compares the lock's paths letter for letter, so "./contracts/..." would have dropped the file's protection), and removes its temporary file when it refuses. The check says so when a locked file is present but untracked. - CONTRIBUTING: the check turns green after the approval and a re-run of the job, as the job summary says. 146 tests. All 65 merged pull requests on main keep their outcome.