| Age | Commit message (Collapse) | Author |
|---|
|
Swap the vendored single-component DataTables downloader build from 1.11.5
to 2.3.8 (docs/_static/js/datatables.js, docs/_static/css/datatables.css).
The only init site, docs/_static/js/tables.js, uses the option-less
jQuery-style $('#id').DataTable() form, which is unchanged in 2.x, so
neither it nor docs/_templates/layout.html needed edits. jQuery 3.6.0 is
still injected ahead of the bundle by sphinxcontrib-jquery and satisfies
2.x.
Remove docs/_static/css/DataTables-1.11.5/ (10 sort-icon images). 2.x draws
sort indicators in pure CSS: the new datatables.css contains no url()
references at all, and the replaced 1.11.5 stylesheet was the only thing in
the repo that referenced those files.
Migrate custom selectors for the 2.x generated-class renames, each verified
against the downloaded bundle rather than assumed:
- .dataTables_info -> .dt-info (tables.css, text.css)
- .paginate_button -> .dt-paging-button (tables.css, text.css)
- #coverage a.paginate_button{,.current,.next,.previous}
-> #coverage button.dt-paging-button{...}
2.x renders paging controls as <button> (was <a> in 1.x), so the old
rules failed on both element type and class. The .current/.next/
.previous modifiers are still emitted and are retained.
The #table-cfgcmd_wrapper / #table-opcmd_wrapper rules are deliberately
untouched: only the wrapper *class* changed (dataTables_wrapper ->
dt-container); the element id is still <tableId>_wrapper.
Drop the CodeQL exclusion (.github/codeql/codeql-config.yml, plus the
optional codeql-cfg-path input in .github/workflows/codeql.yml). That
config existed solely to paths-ignore the 1.11.5 bundle, which tripped 7
alerts (5x js/incomplete-multi-character-sanitization, 2x
js/incomplete-sanitization). Upstream 2.x hardened the implicated helpers -
_stripHtml now runs a do/while fixpoint over the <script> strip, and
_escapeHtml uses all-global regexes - so those patterns are not expected to
recur. Removing the exclusion restores default CodeQL coverage of the file;
this PR's own CodeQL run is the empirical test.
Provenance (DataTables downloader builder, styling "DataTables default",
component set dt only - the 2.x equivalent of the previous #dt/dt-1.11.5):
https://cdn.datatables.net/v/dt/dt-2.3.8/datatables.js
sha256 184fb4bd0b9a81a955acd608ba94d0643c74271e78c0fae30f1f40b824f88b1d
https://cdn.datatables.net/v/dt/dt-2.3.8/datatables.css
sha256 e37677437e0fbe4a463aafc83bc4ea8d60986b72050ba9f47f740b41148184ae
Verified with a local make html: build succeeded, and coverage.html renders
both tables (table-cfgcmd 9095 rows, table-opcmd 3036 rows) with the 2.3.8
assets injected in the correct order after jQuery.
🤖 Generated by [robots](https://vyos.io)
|
|
* security: remediate CodeQL code-scanning alerts (picker XSS sinks, test sanitization, vendored DataTables exclusion)
Remediates all 11 open CodeQL alerts on the default branch:
- version-picker.js (js/xss-through-dom, alerts 1-3): percent-encode every
DOM-derived path component (select.value, parsed location segments) at URL
construction time via encodePath()/langUrlFor(), and tighten the
parseLocation slug charset to [A-Za-z0-9._-]. No-op on legitimate sphinx
slugs — URLs stay byte-identical (asserted by tests).
- workers/apex/test/manifest.test.ts (js/incomplete-multi-character-
sanitization, alert 6): strip HTML comments from the root.html fixture
repeatedly to a fixpoint instead of a single pass.
- docs/_static/js/datatables.js (alerts 4,5,7-11): excluded from CodeQL
analysis via .github/codeql/codeql-config.yml (new codeql-cfg-path input
to the fleet reusable workflow). The file is vendored stock DataTables
1.11.5; the flagged helpers are display/sort normalization, not
sanitization boundaries. Excluding keeps the vendored copy byte-identical
to upstream instead of hand-patching it.
Adds 9 picker tests (hostile-input encoding + slug-charset accept/reject);
workers suite 103/103 green.
🤖 Generated by [robots](https://vyos.io)
* security: normalize pre-existing percent escapes in encodePath
Adversarial-review finding (Codex, medium): location.pathname returns
well-formed escapes verbatim, so blind encodeURIComponent double-encoded
them (%2E -> %252E), broke the HEAD probe on escaped deep links, and
dumped the user at the version root. Each segment is now decoded first
(malformed escapes keep the raw segment — no throw), then re-encoded to
canonical single encoding. Decoding cannot resurrect dot-segments:
the URL parser resolves '.'/'..' and their percent-encoded forms during
navigation, so pathname never presents them (verified against the WHATWG
parser in Node).
workers suite 106/106 (+2 regression tests, mutation-verified).
🤖 Generated by [robots](https://vyos.io)
* security: normalize percent escapes per run, not per segment
Round-2 adversarial finding (Codex, medium): whole-segment decode meant
one malformed escape (a%20b%zz) threw for the segment and double-encoded
the valid escapes beside it. encodeSegment now decodes+re-encodes each
well-formed %HH run independently; literal spans (including a bare '%')
always pass through encodeURIComponent, so taint neutralization holds
unconditionally; a run decoding to invalid UTF-8 stays verbatim (already
pure %HH text).
workers suite 108/108 (+2 discriminating regression tests).
🤖 Generated by [robots](https://vyos.io)
|
|
🤖 Generated by [robots](https://vyos.io)
|
