Skip to content

Test automation#1

Open
hnvadobe wants to merge 602 commits into
stagefrom
test-automation
Open

Test automation#1
hnvadobe wants to merge 602 commits into
stagefrom
test-automation

Conversation

@hnvadobe

@hnvadobe hnvadobe commented May 12, 2025

Copy link
Copy Markdown
Owner
  • Add your
  • Specific
  • Features or fixes

Resolves: MWPW-NUMBER

Test URLs:

GNav Test URLs

Gnav + Footer + Region Picker modal:

Thin Gnav + ThinFooter + Region Picker dropup:

Localnav + Promo:

Sticky Branch Banner:

Blog

RTL Locale

meganthecoder and others added 30 commits February 13, 2025 08:28
* MWPW-167216 Support AEM PAGE/LIVE for PDF Viewer

* backwards compatibility and remove query env
* Adds a check for gnav v2 to ensure no console errors on gnav v1 sites

* additional test for this case
* Update mep target msg for postlcp

* Remove unused variable
… cards layout (adobecom#3666)

corrected grid columns number for three cards on plans
* [MWPW-155282] tooltip enhancements

* [MWPW-155282] optimization

* [MWPW-155282] tooltip distance fix
* Revert "MWPW-140452 - Icon authoring in milo using the federal repo a… (adobecom#3357)

Revert "MWPW-140452 - Icon authoring in milo using the federal repo and individual SVG assets (adobecom#3259)"

This reverts commit 81a5770.

* [Release] Stage to Main (adobecom#3497)

MWPW-165774 [Mobile-GNAV] page is not scrollable in live page (adobecom#3495)

* check for new nav when disabling ios scroll

* shortened the check from the previous commit

Co-authored-by: Raghav Sharma <118168183+sharmrj@users.noreply.github.com>

* adding the log

* updated the log

---------

Co-authored-by: milo-pr-merge[bot] <169241390+milo-pr-merge[bot]@users.noreply.github.com>
Co-authored-by: Okan Sahin <39759830+mokimo@users.noreply.github.com>
Co-authored-by: Raghav Sharma <118168183+sharmrj@users.noreply.github.com>
Co-authored-by: Saloni Jain <saljain@Salonis-MacBook-Pro-2.local>
* fixed the flaky test for logWebVitalsUtils.test.js (#1)

* fixed the flaky test

* move performance mock to beforeEach/afterEach for isolation, simplify lcpElType check

* removed unused code

* fixed the same issue in logWebVitals.test.js and reverted unnecessary changes

* Update fstab.yaml

* Update fstab.yaml

* Update fstab.yaml

* Update fstab.yaml

* Update fstab.yaml

* enhanced tool tips Unit tests

* added assertions and isolated DOM state

* changed unnecessary async to sync

* added loadIcons for duplicate test

* tooltip should be visible on hover

* added a test case for visibility of tooltip

* testcase for tooltip visibility

* Changes visibility test case & gave appropriate name to tests

* Update test/features/icons/icons.test.js

Co-authored-by: Robert Bogos <146744221+robert-bogos@users.noreply.github.com>

---------

Co-authored-by: Robert Bogos <146744221+robert-bogos@users.noreply.github.com>
…t mode when the text is long (adobecom#3672)

fix situations where a line break was needed in a mega menu in the mobile gnav
…ost branch quick link (adobecom#3687)

* ecid null case

* ecid access

* branch banner

* reverting change

---------

Co-authored-by: Drashti Modasara <dmodasara@drashtis-mbp.corp.adobe.com>
* Fixing lana log tags and error types

* Adding standalone gnavs as meta source for lana logging

* Adding lana log for standalone onError

* Lint and test case fix

* Fixing test case

* Fixing test case

* Fixing test case

* Lint fix

* Code fix

* Adding test case for breadcrumbs

* Code fix

* Removing unnecessary log

* Removing unnecessary log
…om#3655)

* Added fix for contrast ratio for blue link on grey background

* Fix other issues

* link color updates for milo as well

* reverted color for button

* reverted color for button

---------

Co-authored-by: Dev Ashish Sardana <glo77801@adobe.com>
* [MWPW-167312] tooltip dismiss escape

* [MWPW-167312] unit test added
* MWPW-164755:Add <br> when copying multiple blocks

* MWPW-164755: Update mocks

* MWPW-164755: Add <br> after every element in the container

* MWPW-164755: Remove string from blob

Co-authored-by: Okan Sahin <39759830+mokimo@users.noreply.github.com>

---------

Co-authored-by: Okan Sahin <39759830+mokimo@users.noreply.github.com>
* Mocked 3rd party script requests

* slack notif test

* Revert "slack notif test"

This reverts commit 3a5c4bf.
* [MWPW-165792] remove nala flags

* [MWPW-165792] added new color check regarding [MWPW-165793]

* [MWPW-165792] update

* [MWPW-165792] marquee test update style

* [MWPW-165792] a11y test adaptation

* [MWPW-165792] video a11y skip added
* Branch banner scenario fix for new Mobile GNAV

* UT skip test removed

* Lint Fixes

* Review comments and MWPW-167996

* Removed unnecessary css

* banner shadow fix

* Fix other issues

* lint fix

---------

Co-authored-by: Dev Ashish Sardana <glo77801@adobe.com>
adobecom#3619)

* new event added for autoplay videos

* combining the fixe for 163031
…m#3653)

* Initial checkin.

* fix nala test promotions.test.js

---------

Co-authored-by: John Pratt <jpratt@adobe.com>
* MWPW-168109: do not modify absolute path to a script hosted in DAM when using insertScript action (adobecom#3708)

* MWPW-168109: do not modify absolute path to a script hosted in DAM when using insertScript action

* wording change

* Update libs/features/personalization/personalization.js

Co-authored-by: Vivian A Goodrich <101133187+vgoodric@users.noreply.github.com>

---------

Co-authored-by: Denys Fedotov <dfedotov@Denyss-MacBook-Pro.local>
Co-authored-by: Vivian A Goodrich <101133187+vgoodric@users.noreply.github.com>

* [MWPW-166126] Add new "updateAttribute" action to MEP (adobecom#3670)

* Get last string, check for match, save as attribute.

* Attribute update, working state.

* Refactor, good state.

* Parameter update refactor.

* Unit testing.

* Highlight updates.

* Unit test update.

* Code review updates.

* Error log update.

* Spacing fix.

* PR update.

* Update libs/features/personalization/personalization.js

* unit test update

---------

Co-authored-by: Vivian A Goodrich <101133187+vgoodric@users.noreply.github.com>
Co-authored-by: Vivian A Goodrich <vgoodric@adobe.com>

---------

Co-authored-by: Denys Fedotov <denlight@gmail.com>
Co-authored-by: Denys Fedotov <dfedotov@Denyss-MacBook-Pro.local>
Co-authored-by: Dave Linhart <132396886+AdobeLinhart@users.noreply.github.com>
…ecom#3698)

* add branch purgining before test run

* update the pr.sh

* add 10 sec wait to purge completion

* added wait time

---------

Co-authored-by: Santoshkumar Sharanappa Nateekar <nateekar@SantoshumarsMBP.lan>
* init upt-link

* mas-element fix

* missing build

* callback check

* correct href

* upt link error handling

* refined link

* ccd revert, encoded URI

* build

* hook name conflict fix

* upt link in hydration

* is attribute

* upt-link fix; nala tests

* nala test updates

* undefined promo code fix

* promo terms url based on env
* after history reset

* opcity change remove dropdown disabled

* comment cleanup

* createPageList fix added search params

* search param update

* remove perpage pagenum from shareurl hrefs

* comment changes

---------

Co-authored-by: Denys Fedotov <dfedotov@Denyss-MacBook-Pro.local>
* [MWPW-168041] pill tab border removal

* [MWPW-168041] optimization
…tics (adobecom#3559)

* DOTCOM-128841, DOTCOM-129276,  Group of navigation links missing semantics

* fix linting errors

* DOTCOM-128841 change p tag to div

* wrap footer links with ul li

* replace span with before element for divider, to mentain semantics

* undo last changes

* move divider in li

* remove divider form semantic testing purpose

* undo last commit

* move copyright inside list

* undo reader fix

* wrap copyright in list item

* remove whitespace

* add fix for two sections
qiyundai and others added 27 commits April 30, 2025 15:09
* Adding Toggle Success Section

* Adding hide section ability

* remove unused timeout

* Update tests

* remove hide timeout again

* Update marketo.js

* remove unnecessary async tag

* simplify tests
Upgrading package version for bundled gnav to 0.0.8
…dobecom#4011)

Fix for text overflow in landscape mode

Fix for text overflow in landscape mode

Fix for text overflow in landscape mode
* test

* susi light initial commit

* susi light WIP

* susi light WIP

* susi light WIP

* susi light unit tests

* susi light refactor

* susi light refactor

* susi light refactor

* susi light refactor

* hide scrollbar

* susi-light rename + design changes

* rename block to susi-ligh-login

* susi light changes

* susi light changes

* change susi light redirection

* susi light login changes
* initial card states styling

* Set quiz-button focus-visible to match cards
* MWPW-167550 [Plans] Swap places for strikethrough price

* build mas

* build mas

* build mas

* Trigger Build

* Trigger Build

---------

Co-authored-by: Bozo Jovicic <bozo@hitthecode.com>
* MWPW-170901 [M@S] Incorrect WCS call in langstore

* MWPW-170901 [M@S] Incorrect WCS call in langstore

* MWPW-170901 [M@S] Incorrect WCS call in langstore

* MWPW-170901 [M@S] Incorrect WCS call in langstore

* Trigger Build

* MWPW-170901 [M@S] Incorrect WCS call in langstore

* Trigger Build

* MWPW-170901 [M@S] Incorrect WCS call in langstore

* MWPW-170901 [M@S] Incorrect WCS call in langstore

* MWPW-170901 [M@S] Incorrect WCS call in langstore

---------

Co-authored-by: Bozo Jovicic <bozo@hitthecode.com>
* [MWPW-170098] - aria label solution

* [MWPW-170098] - remove lines

* [MWPW-170098] - aria-checked, radiogroup implemented

* [MWPW-170098] - update

* [MWPW-170098] - update
…t cleanup (adobecom#4031)

* console test

* api checks

* working state. pre button removal and grid changes

* remove share functions

* styling changes and minimum checkbox req

* add breakpoint styling and error messaging

* review version added, target cleanup report supported

* mmm current version, some items from mmm-report changes

* [MWPW-171966] - added table sorting for MMM Target Cleanup report

* first commit. reformatted report rows

* added link target

* added button class

* wording change to chart

* merging items

* add label changes

* adjusted spacing columns

* test fix

* removed share btn

* test fix

* Update libs/blocks/mmm/mmm.css

Co-authored-by: Mark Perry <124626043+markpadbe@users.noreply.github.com>

* good state. before working session

* readd changes ivan

* padding on cleanup report and email button current

* report select all label sizing change

* enable email report button instance

* replaced email feature with copy and open slack buttons

* added error and success messaging to copy feature

* added cursor styling to buttons

* added non qa slack channel link, changed clipboard messaging with single or multi url message

* remove console messages

* fix duplicate ids for 2 containers

* remove console

* fix typo in describe block for target cleanup report

---------

Co-authored-by: viloria <viloria@adobe.com>
Co-authored-by: Denys Fedotov <dfedotov@Denyss-MacBook-Pro.local>
Co-authored-by: Mark Perry <124626043+markpadbe@users.noreply.github.com>
Co-authored-by: Vivian A Goodrich <vgoodric@adobe.com>
* [MWPW-170489] - selector expanded

* [MWPW-170489] - notification japan cta fix
* MWPW-171326: Fix text overflow in table heading

* MWPW-171326: PR update
* MWPW-171881 - Adding manual params to 3in1 URL

* af rf and test fixes

* param override fixes

* restructure

* nala fix

* new nala links

* nala fix

* tests

* another nala fix

* unhide tabs crm modal tests
* MWPW-171131: cli update for M7 links

* meta link
* MWPW-170799: Remove external.js and refactor imports.

* fix regressions

* fix regressions

* fix checks

* fix checks

* still regression in variants

* fix regression on ccd ah styles

* disable aggressive PR comments

* remove unused file

* fix regressions

* fix error in doc page

* PR review

* fix regression in variant mappings

* fix plans url

* cleanup constants

* WIP

* WIP

* PR review

* WIP

* merge stage and fix regressions

* MWPW-167198: apply displayPlanType setting from fragment to price

The displayPlanType setting from the fragment was not being properly applied to
the inline-price component. This fix ensures that the setting is correctly
propagated from the fragment settings to the price options.

- Added price options provider registration in merch-card
- Updated hydrate.js to properly handle settings
- Fixed test to verify the setting is applied correctly

* fix issue

* reuse existing var for css

* merge stage

* build latest

* merge stage

* tax inclusivity text in US should never be shown

* fix nala tests

* Update template

* Update template

* introduce a new separate price template named legal

it will be programmatically added by the plans card variant at the end of price container.

* prevent fragment re-load

* prevent fragment re-load

* keep legal template after fragment refresh

* fix support in Milo

* add build:bundle:dev script

* merge latest stage
* Addd ome noise

* Just turn it all off for a second

* Add data-prerendered check

* Add test

* Use page-load-ok-milo div instead

* Fix fixture

* Refactor fixture

* Fix richresults tests

* Fix fragment loading

* Update libs/utils/utils.js

Co-authored-by: Rares Munteanu <overmyheadandbody@gmail.com>

* Update libs/utils/utils.js

Co-authored-by: Chris Peyer <chrischrischris@users.noreply.github.com>

---------

Co-authored-by: Rares Munteanu <overmyheadandbody@gmail.com>
Co-authored-by: Chris Peyer <chrischrischris@users.noreply.github.com>
* MWPW-171040: support for url formats lan/reg

* fix linting issue

* Update libs/blocks/region-nav/region-nav.js

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* prefix for user interaction

* change to prefix for replacement

* refactor prefix handling based on suggestion

* include language config support

* init tests cases

* Update libs/blocks/region-nav/region-nav.js

flattens iteration

Co-authored-by: Chris Peyer <chrischrischris@users.noreply.github.com>

* Fix async / await on test init

---------

Co-authored-by: Yeiber Cano <cano@Yeibers-MacBook-Pro-2.local>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Chris Peyer <chrischrischris@users.noreply.github.com>
)

* Fixing lana error type field

* Adding error type for localnav

* Fixing warn tag

* lint fix

* Changing error type
* adding select option for cta text

* textOption test updated

---------

Co-authored-by: Predrag Markovic <cod14230@adobe.com>
* [MWPW-172157] - fix tab error

* [MWPW-172157] - null safe added
* MWPW-172997: fix annual price with promotion rounding

 only applies to a promotion with a duration
 and a percentage discount

* when OST on MAS is built with the latest
Milo OST will benefit from it OOTB.

* 170031 and 169841 add-on and quantity

* addonCheckbox and inline price min-height

* fixed cs param for not 3in1 CTAs

* fixed nala

* nala tabs

---------

Co-authored-by: Ilyas Türkben <ilyas@adobe.com>
@aem-code-sync

aem-code-sync Bot commented May 12, 2025

Copy link
Copy Markdown

Hello, I'm the AEM Code Sync Bot and I will run some actions to deploy your branch and validate page speed.
In case there are problems, just click a checkbox below to rerun the respective action.

  • Re-run PSI checks
  • Re-sync branch
Commits

switch (subType) {
case 'EXTERNAL':
if (!data?.externalUrl || !data?.target) return;
window.open(data.externalUrl, data.target);

Check warning

Code scanning / CodeQL

Client-side URL redirect Medium

Untrusted URL redirection depends on a
user-provided value
.

Copilot Autofix

AI about 1 year ago

To fix the issue, we need to validate the data.externalUrl value against a whitelist of allowed origins before using it in the window.open call. This ensures that only trusted URLs can be used for redirection. The ALLOWED_MESSAGE_ORIGINS array can be reused for this purpose. If the URL's origin is not in the whitelist, the redirection should be blocked.

The changes will involve:

  1. Parsing the data.externalUrl into a URL object.
  2. Checking if the origin of the parsed URL is in the ALLOWED_MESSAGE_ORIGINS list.
  3. Proceeding with the redirection only if the origin is allowed.
Suggested changeset 1
libs/blocks/iframe/iframe.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/libs/blocks/iframe/iframe.js b/libs/blocks/iframe/iframe.js
--- a/libs/blocks/iframe/iframe.js
+++ b/libs/blocks/iframe/iframe.js
@@ -12,3 +12,12 @@
       if (!data?.externalUrl || !data?.target) return;
-      window.open(data.externalUrl, data.target);
+      try {
+        const externalUrl = new URL(data.externalUrl);
+        if (ALLOWED_MESSAGE_ORIGINS.includes(externalUrl.origin)) {
+          window.open(data.externalUrl, data.target);
+        } else {
+          console.warn(`Blocked redirection to untrusted origin: ${externalUrl.origin}`);
+        }
+      } catch (error) {
+        console.error(`Invalid URL provided for redirection: ${data.externalUrl}`);
+      }
       break;
@@ -16,3 +25,12 @@
       if (!data?.externalUrl || !data?.target) return;
-      window.open(data.externalUrl, data.target);
+      try {
+        const externalUrl = new URL(data.externalUrl);
+        if (ALLOWED_MESSAGE_ORIGINS.includes(externalUrl.origin)) {
+          window.open(data.externalUrl, data.target);
+        } else {
+          console.warn(`Blocked redirection to untrusted origin: ${externalUrl.origin}`);
+        }
+      } catch (error) {
+        console.error(`Invalid URL provided for redirection: ${data.externalUrl}`);
+      }
       break;
EOF
@@ -12,3 +12,12 @@
if (!data?.externalUrl || !data?.target) return;
window.open(data.externalUrl, data.target);
try {
const externalUrl = new URL(data.externalUrl);
if (ALLOWED_MESSAGE_ORIGINS.includes(externalUrl.origin)) {
window.open(data.externalUrl, data.target);
} else {
console.warn(`Blocked redirection to untrusted origin: ${externalUrl.origin}`);
}
} catch (error) {
console.error(`Invalid URL provided for redirection: ${data.externalUrl}`);
}
break;
@@ -16,3 +25,12 @@
if (!data?.externalUrl || !data?.target) return;
window.open(data.externalUrl, data.target);
try {
const externalUrl = new URL(data.externalUrl);
if (ALLOWED_MESSAGE_ORIGINS.includes(externalUrl.origin)) {
window.open(data.externalUrl, data.target);
} else {
console.warn(`Blocked redirection to untrusted origin: ${externalUrl.origin}`);
}
} catch (error) {
console.error(`Invalid URL provided for redirection: ${data.externalUrl}`);
}
break;
Copilot is powered by AI and may make mistakes. Always verify output.
break;
case 'SWITCH':
if (!data?.externalUrl || !data?.target) return;
window.open(data.externalUrl, data.target);

Check warning

Code scanning / CodeQL

Client-side URL redirect Medium

Untrusted URL redirection depends on a
user-provided value
.

Copilot Autofix

AI about 1 year ago

To fix the issue, we need to validate data.externalUrl against a whitelist of allowed origins before using it in window.open. This can be achieved by extracting the origin of data.externalUrl and checking it against the ALLOWED_MESSAGE_ORIGINS array. If the origin is not in the whitelist, the function should not proceed with the redirection. This ensures that only trusted URLs are used for redirection.


Suggested changeset 1
libs/blocks/iframe/iframe.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/libs/blocks/iframe/iframe.js b/libs/blocks/iframe/iframe.js
--- a/libs/blocks/iframe/iframe.js
+++ b/libs/blocks/iframe/iframe.js
@@ -12,3 +12,12 @@
       if (!data?.externalUrl || !data?.target) return;
-      window.open(data.externalUrl, data.target);
+      try {
+        const url = new URL(data.externalUrl);
+        if (!ALLOWED_MESSAGE_ORIGINS.includes(url.origin)) {
+          console.warn(`Blocked redirection to untrusted origin: ${url.origin}`);
+          return;
+        }
+        window.open(data.externalUrl, data.target);
+      } catch (error) {
+        console.error(`Invalid URL provided for redirection: ${data.externalUrl}`);
+      }
       break;
@@ -16,3 +25,12 @@
       if (!data?.externalUrl || !data?.target) return;
-      window.open(data.externalUrl, data.target);
+      try {
+        const url = new URL(data.externalUrl);
+        if (!ALLOWED_MESSAGE_ORIGINS.includes(url.origin)) {
+          console.warn(`Blocked redirection to untrusted origin: ${url.origin}`);
+          return;
+        }
+        window.open(data.externalUrl, data.target);
+      } catch (error) {
+        console.error(`Invalid URL provided for redirection: ${data.externalUrl}`);
+      }
       break;
EOF
@@ -12,3 +12,12 @@
if (!data?.externalUrl || !data?.target) return;
window.open(data.externalUrl, data.target);
try {
const url = new URL(data.externalUrl);
if (!ALLOWED_MESSAGE_ORIGINS.includes(url.origin)) {
console.warn(`Blocked redirection to untrusted origin: ${url.origin}`);
return;
}
window.open(data.externalUrl, data.target);
} catch (error) {
console.error(`Invalid URL provided for redirection: ${data.externalUrl}`);
}
break;
@@ -16,3 +25,12 @@
if (!data?.externalUrl || !data?.target) return;
window.open(data.externalUrl, data.target);
try {
const url = new URL(data.externalUrl);
if (!ALLOWED_MESSAGE_ORIGINS.includes(url.origin)) {
console.warn(`Blocked redirection to untrusted origin: ${url.origin}`);
return;
}
window.open(data.externalUrl, data.target);
} catch (error) {
console.error(`Invalid URL provided for redirection: ${data.externalUrl}`);
}
break;
Copilot is powered by AI and may make mistakes. Always verify output.
};

const redirectIfLoggedIn = async (destURL) => {
const redirect = () => window.location.replace(destURL);

Check warning

Code scanning / CodeQL

DOM text reinterpreted as HTML Medium

DOM text
is reinterpreted as HTML without escaping meta-characters.

Copilot Autofix

AI about 1 year ago

To fix the issue, we need to ensure that the destURL parameter passed to window.location.replace is sanitized and validated. This can be achieved by:

  1. Validating that destURL is a well-formed and safe URL before using it in window.location.replace.
  2. Escaping or encoding any potentially unsafe characters in the text extracted from the DOM to prevent it from being interpreted as malicious input.

The best approach is to use a URL validation function to ensure that destURL is a valid and safe URL. If the URL is invalid or unsafe, we can either reject it or replace it with a default safe URL.


Suggested changeset 1
libs/blocks/susi-light-login/susi-light-login.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/libs/blocks/susi-light-login/susi-light-login.js b/libs/blocks/susi-light-login/susi-light-login.js
--- a/libs/blocks/susi-light-login/susi-light-login.js
+++ b/libs/blocks/susi-light-login/susi-light-login.js
@@ -8,4 +8,19 @@
 
+const isValidURL = (url) => {
+  try {
+    const parsed = new URL(url);
+    return ['http:', 'https:'].includes(parsed.protocol);
+  } catch {
+    return false;
+  }
+};
+
 const redirectIfLoggedIn = async (destURL) => {
-  const redirect = () => window.location.replace(destURL);
+  const redirect = () => {
+    if (isValidURL(destURL)) {
+      window.location.replace(destURL);
+    } else {
+      window.lana?.log(`Invalid redirect URL: ${destURL}`);
+    }
+  };
   try {
EOF
@@ -8,4 +8,19 @@

const isValidURL = (url) => {
try {
const parsed = new URL(url);
return ['http:', 'https:'].includes(parsed.protocol);
} catch {
return false;
}
};

const redirectIfLoggedIn = async (destURL) => {
const redirect = () => window.location.replace(destURL);
const redirect = () => {
if (isValidURL(destURL)) {
window.location.replace(destURL);
} else {
window.lana?.log(`Invalid redirect URL: ${destURL}`);
}
};
try {
Copilot is powered by AI and may make mistakes. Always verify output.
document.querySelectorAll('code.demo').forEach(el => {
const targetContainer = document.createElement('div');
targetContainer.classList.toggle('light', el.classList.contains('light'));
targetContainer.innerHTML = `<h4>Demo: </h4><div class="demo-container">${el.textContent}</div>`;

Check warning

Code scanning / CodeQL

DOM text reinterpreted as HTML Medium documentation

DOM text
is reinterpreted as HTML without escaping meta-characters.

Copilot Autofix

AI about 1 year ago

To fix the issue, we need to ensure that the content of el.textContent is properly escaped before being interpolated into the HTML string. This can be achieved by using a utility function to escape special HTML characters (<, >, &, ", ') in el.textContent. The escaped content can then be safely included in the innerHTML assignment.

The fix involves:

  1. Adding a helper function to escape HTML special characters.
  2. Using this helper function to sanitize el.textContent before interpolating it into the HTML string.

Suggested changeset 1
libs/features/mas/docs/ccd.html

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/libs/features/mas/docs/ccd.html b/libs/features/mas/docs/ccd.html
--- a/libs/features/mas/docs/ccd.html
+++ b/libs/features/mas/docs/ccd.html
@@ -65,2 +65,9 @@
 <script type="module">
+  function escapeHTML(str) {
+      return str.replace(/&/g, '&amp;')
+                .replace(/</g, '&lt;')
+                .replace(/>/g, '&gt;')
+                .replace(/"/g, '&quot;')
+                .replace(/'/g, '&#39;');
+  }
   document.querySelectorAll('code.demo').forEach(el => {
@@ -68,3 +75,3 @@
       targetContainer.classList.toggle('light', el.classList.contains('light'));
-      targetContainer.innerHTML = `<h4>Demo: </h4><div class="demo-container">${el.textContent}</div>`;
+      targetContainer.innerHTML = `<h4>Demo: </h4><div class="demo-container">${escapeHTML(el.textContent)}</div>`;
       el.parentElement.after(targetContainer);
EOF
@@ -65,2 +65,9 @@
<script type="module">
function escapeHTML(str) {
return str.replace(/&/g, '&amp;')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&#39;');
}
document.querySelectorAll('code.demo').forEach(el => {
@@ -68,3 +75,3 @@
targetContainer.classList.toggle('light', el.classList.contains('light'));
targetContainer.innerHTML = `<h4>Demo: </h4><div class="demo-container">${el.textContent}</div>`;
targetContainer.innerHTML = `<h4>Demo: </h4><div class="demo-container">${escapeHTML(el.textContent)}</div>`;
el.parentElement.after(targetContainer);
Copilot is powered by AI and may make mistakes. Always verify output.
document.querySelectorAll('code.demo').forEach(el => {
const targetContainer = document.createElement('div');
targetContainer.classList.toggle('light', el.classList.contains('light'));
targetContainer.innerHTML = `<h4>Demo: </h4><div class="demo-container">${el.textContent}</div>`;

Check warning

Code scanning / CodeQL

DOM text reinterpreted as HTML Medium documentation

DOM text
is reinterpreted as HTML without escaping meta-characters.

Copilot Autofix

AI about 1 year ago

To fix the issue, we need to ensure that any potentially unsafe content from el.textContent is properly escaped before being inserted into the DOM. Instead of directly interpolating el.textContent into the innerHTML string, we can use a text node to safely handle the content. This approach avoids interpreting the text as HTML, thereby mitigating the risk of XSS.

The fix involves:

  1. Creating a new div element for the .demo-container.
  2. Setting the text content of the .demo-container using textContent instead of interpolating it into an HTML string.
  3. Appending the .demo-container to the targetContainer.

Suggested changeset 1
libs/features/mas/docs/checkout-button.html

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/libs/features/mas/docs/checkout-button.html b/libs/features/mas/docs/checkout-button.html
--- a/libs/features/mas/docs/checkout-button.html
+++ b/libs/features/mas/docs/checkout-button.html
@@ -336,3 +336,9 @@
       targetContainer.classList.toggle('light', el.classList.contains('light'));
-      targetContainer.innerHTML = `<h4>Demo: </h4><div class="demo-container">${el.textContent}</div>`;
+      const demoHeader = document.createElement('h4');
+      demoHeader.textContent = 'Demo: ';
+      const demoContainer = document.createElement('div');
+      demoContainer.className = 'demo-container';
+      demoContainer.textContent = el.textContent;
+      targetContainer.appendChild(demoHeader);
+      targetContainer.appendChild(demoContainer);
       el.parentElement.after(targetContainer);
EOF
@@ -336,3 +336,9 @@
targetContainer.classList.toggle('light', el.classList.contains('light'));
targetContainer.innerHTML = `<h4>Demo: </h4><div class="demo-container">${el.textContent}</div>`;
const demoHeader = document.createElement('h4');
demoHeader.textContent = 'Demo: ';
const demoContainer = document.createElement('div');
demoContainer.className = 'demo-container';
demoContainer.textContent = el.textContent;
targetContainer.appendChild(demoHeader);
targetContainer.appendChild(demoContainer);
el.parentElement.after(targetContainer);
Copilot is powered by AI and may make mistakes. Always verify output.
});

const result = await getFilesToPromote({
accessToken: 'token',

Check failure

Code scanning / CodeQL

Hard-coded credentials Critical test

The hard-coded value "token" is used as
authorization header
.

it('should return files for paths ending with .json', async () => {
const result = await getFilesToPromote({
accessToken: 'token',

Check failure

Code scanning / CodeQL

Hard-coded credentials Critical test

The hard-coded value "token" is used as
authorization header
.

it('should return html files for paths not ending with slash or .json', async () => {
const result = await getFilesToPromote({
accessToken: 'token',

Check failure

Code scanning / CodeQL

Hard-coded credentials Critical test

The hard-coded value "token" is used as
authorization header
.

it('should handle empty paths array', async () => {
const result = await getFilesToPromote({
accessToken: 'token',

Check failure

Code scanning / CodeQL

Hard-coded credentials Critical test

The hard-coded value "token" is used as
authorization header
.
requestHandlerStub.resolves({ ok: false });

const result = await getFilesToPromote({
accessToken: 'token',

Check failure

Code scanning / CodeQL

Hard-coded credentials Critical test

The hard-coded value "token" is used as
authorization header
.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.