Skip to content

fix(security): CI token permissions + stripAnsi ReDoS - #52

Merged
ArianAr merged 1 commit into
mainfrom
fix/codeql-remaining-alerts
Jul 15, 2026
Merged

fix(security): CI token permissions + stripAnsi ReDoS#52
ArianAr merged 1 commit into
mainfrom
fix/codeql-remaining-alerts

Conversation

@ArianAr

@ArianAr ArianAr commented Jul 15, 2026

Copy link
Copy Markdown
Owner

Summary

Clears remaining open CodeQL alerts after #51.

Alert Rule Fix
#2, #7–#11 actions/missing-workflow-permissions Workflow-level permissions: contents: read on ci.yml
#6 js/polynomial-redos Replace nested-quantifier ANSI regexes with a linear scan in stripAnsi

Incomplete OSC sequences only drop ESC]; following plain text is kept (and the former ReDoS shape of many ESC] prefixes no longer risks quadratic backtracking).

Test plan

@ArianAr
fix(security): clear remaining CodeQL workflow and ReDoS alerts
773da03 
- CI: explicit permissions.contents: read (missing-workflow-permissions)
- stripAnsi: linear scan instead of nested quantifier regexes
  (js/polynomial-redos); incomplete OSC no longer eats trailing text

Addresses code scanning alerts #2, #6–#11.
@ArianAr ArianAr added security Security-related issue or fix (non-advisory tracking) area:server Next.js server / API area:ci GitHub Actions, branch protection, tooling labels Jul 15, 2026
@ArianAr
ArianAr merged commit b613b05 into main Jul 15, 2026
9 of 10 checks passed
@ArianAr
ArianAr deleted the fix/codeql-remaining-alerts branch July 15, 2026 21:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area:ci GitHub Actions, branch protection, tooling area:server Next.js server / API security Security-related issue or fix (non-advisory tracking)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ArianAr