fix(security): harden HTML text extraction and restrict CI token #1

2026-10-16T21:06:59Z

KofTwentyTwo commented

2026-10-16 21:06:59 +00:00

(Migrated from github.com)

Fixes #2

Fixes code-scanning alerts #2-#5 (js/bad-tag-filter, js/incomplete-multi-character-sanitization, js/double-escaping) in packages/jarvis-file-backend/lib/context-reader.js and #1 (actions/missing-workflow-permissions) in .github/workflows/ci.yml.

Tag/block removal loops until the text is stable, so split tags such as <scr<script>x</script>ipt> cannot reassemble.
Closing </script ...> / </style ...> variants are matched.
& is decoded last.
Workflow-level permissions: contents: read.

Verification: node --check and a smoke test with nested/split tags and encoded entities (output contains no tags).

🤖 Generated with Claude Code

Fixes #2 Fixes code-scanning alerts #2-#5 (`js/bad-tag-filter`, `js/incomplete-multi-character-sanitization`, `js/double-escaping`) in `packages/jarvis-file-backend/lib/context-reader.js` and #1 (`actions/missing-workflow-permissions`) in `.github/workflows/ci.yml`. - Tag/block removal loops until the text is stable, so split tags such as `<scr<script>x</script>ipt>` cannot reassemble. - Closing `</script ...>` / `</style ...>` variants are matched. - `&` is decoded last. - Workflow-level `permissions: contents: read`. Verification: `node --check` and a smoke test with nested/split tags and encoded entities (output contains no tags). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

github-advanced-security[bot] (Migrated from github.com) reviewed

2026-10-16 21:07:47 +00:00

packages/jarvis-file-backend/lib/context-reader.js

						
				@@ -43,0 +46,4 @@

				         .replace(/<style\b[\s\S]*?<\/style\b[^>]*>/gi, "")

				         .replace(/<[^>]+>/g, " ");

				   }

				   return text

github-advanced-security[bot] (Migrated from github.com) commented

2026-10-16 21:07:47 +00:00

CodeQL / Incomplete multi-character sanitization

This string may still contain <script, which may cause an HTML element injection vulnerability.

Show more details

## CodeQL / Incomplete multi-character sanitization This string may still contain [<script](1), which may cause an HTML element injection vulnerability. [Show more details](https://github.com/KofTwentyTwo/jarvis-file/security/code-scanning/7)

packages/jarvis-file-backend/lib/context-reader.js

						
				@@ -43,1 +47,4 @@

				         .replace(/<[^>]+>/g, " ");

				   }

				   return text

				      .replace(/&nbsp;/g, " ")

github-advanced-security[bot] (Migrated from github.com) commented

2026-10-16 21:07:47 +00:00

CodeQL / Incomplete multi-character sanitization

This string may still contain <style, which may cause an HTML element injection vulnerability.

Show more details

## CodeQL / Incomplete multi-character sanitization This string may still contain [<style](1), which may cause an HTML element injection vulnerability. [Show more details](https://github.com/KofTwentyTwo/jarvis-file/security/code-scanning/6)

Checking for merge conflicts…

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feature/security-findings-2026-10:feature/security-findings-2026-10

git checkout feature/security-findings-2026-10

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/jarvis-file#1