fix: TTS sanitization (code-scanning #21) + repair broken Playwright e2e suite (#190)#191
Open
devartifex wants to merge 2 commits into
Open
fix: TTS sanitization (code-scanning #21) + repair broken Playwright e2e suite (#190)#191devartifex wants to merge 2 commits into
devartifex wants to merge 2 commits into
Conversation
Apply iterative tag removal to handle nested/split tags like <scr<script>ipt> that survive a single-pass replace. Fixes code-scanning alert #21 (js/incomplete-multi-character-sanitization). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| function stripHtmlTags(text: string): string { | ||
| const tagPattern = /<[^>]*>/g; | ||
| let previous = text; | ||
| let result = text.replace(tagPattern, ''); |
The e2e suite had been failing/timing out in CI. Two root causes: 1. Rate limiting: hooks.server.ts capped requests at 200/15min/IP unconditionally. The full suite issues far more than that from a single IP, so every request 429'd, the chat never loaded, and CI hit the 30-minute timeout. Made the cap configurable via RATE_LIMIT_MAX (0 disables) and set it to 0 in the Playwright webServer env and the CI e2e step. 2. Stale specs vs. UI redesigns: ~34 tests referenced removed/renamed markup and behavior (voice mic button, TopBar connection dot removal, persistent desktop Sidebar with renamed classes, SourcedAgentInfo agents shape, additionalInstructions settings field, usage-before-turn_end ordering, looser SSR auth regex). Updated the specs and helpers (added viewport-aware openSidebar) to match the current components. Auth-flow tests also needed service workers blocked: the SW's controllerchange handler reloads the page, and the precached HTML dropped the test's auth patch, flipping back to the login screen. All 126 desktop e2e tests now pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
added
documentation
devartifex
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR bundles two related maintenance fixes.
1. Code-scanning #21 — incomplete multi-character sanitization (TTS)
stripHtmlTags()insrc/lib/stores/tts.svelte.tsremoved HTML tags with asingle non-iterative regex pass, which could leave behind tag fragments on
crafted input (CodeQL
js/incomplete-multi-character-sanitization). Replacedwith an iterative strip that runs until the string stabilizes.
2. Issue #190 — broken Playwright e2e suite
The e2e suite had been failing/timing out in CI. Two root causes:
Rate limiting.
hooks.server.tscapped requests at 200/15 min/IPunconditionally. The full suite issues far more than that from a single IP,
so every request
429'd, the chat never loaded, and CI hit the 30-minutetimeout. The cap is now configurable via
RATE_LIMIT_MAX(0disables) andset to
0in the PlaywrightwebServerenv.Stale specs vs. UI redesigns. ~34 tests referenced removed/renamed markup
and behavior:
.sidebar,.sidebar-backdrop)SourcedAgentInfoagents shape (source/isSelected)additionalInstructionssettings field (wascustomInstructions)usagemessage must precedeturn_endbyokEnabled)Specs and helpers were updated to match the current components (added a
viewport-aware
openSidebarhelper). Auth-flow tests additionally neededservice workers blocked: the SW's
controllerchangehandler reloads thepage, and the precached HTML dropped the test's auth patch, flipping back to
the login screen.
Verification
--project=desktopmatrix CI runs).hooks.server.test.ts(20) andconfig.test.ts(14) unit tests pass.Closes #190