Skip to content

fix(json): re-quote single-quoted strings correctly in parseJson - #569

Merged
MaksymStoianov merged 2 commits into
developfrom
fix/codeql-alerts
Nov 3, 2026
Merged

MaksymStoianov merged 2 commits into
developfrom
fix/codeql-alerts

Conversation

@MaksymStoianov

Copy link
Copy Markdown
Member

Fixes the open CodeQL alerts:

  • src/json/parseJson.ts (alerts 7, 8, incomplete sanitization) — real bugs: inputs like 'say "hi"' and \' failed to parse. 7 tests added, 5 of them failed on the old code.
  • scripts/docs (alerts 12, 13, 17): table cells escaped fully, old links matched without a hostname regexp; generated docs unchanged.

🤖 Generated with Claude Code

MaksymStoianov and others added 2 commits November 3, 2026 16:25
A double quote inside a single-quoted string was copied into the
double-quoted result unescaped, and an escaped single quote kept a
backslash JSON does not accept, so such input threw. Quoted keys no
longer lose their inner quotes either. Fixes CodeQL
js/incomplete-sanitization alerts 7 and 8.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Maksym Stoianov <stoianov.maksym@gmail.com>
escapeCell escapes backslashes before pipes, and the translated reference
tables use it too. The link fix-up in sync-jsdoc-links compares the
literal URL instead of building a regexp from it. Generated output is
unchanged. Fixes CodeQL alerts 12, 13 (js/incomplete-sanitization) and
17 (js/incomplete-hostname-regexp).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Maksym Stoianov <stoianov.maksym@gmail.com>
@MaksymStoianov
MaksymStoianov merged commit cd481fb into develop Nov 3, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant