Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@appatalks
Copy link
Owner

Adding gpt-5-mini as new model, and adding LCARS inspired theme as default. Some cleaner functionality including markdown support.

appatalks and others added 25 commits April 2, 2025 18:47
…t-instructions; update README; create feature/gpt5-mini branch
…th warning; ignore config.local.js; docs updated
…3, gemini, lm-studio] when LCARS is active; restore full list on exit; preserve selection
…ings/Clear/Speak/Print with tooltips; scale speak icon
// Google That
const keyword_google = 'google';
const keyword_Google = 'Google';
const query = sQuestion.replace(/<[^>]*>/g, '').replace(/google|Google/g, '').trim();

Check failure

Code scanning / CodeQL

Incomplete multi-character sanitization

This string may still contain [<script](1), which may cause an HTML element injection vulnerability.

Copilot Autofix

AI 3 months ago

The best way to fix this problem is to ensure that all HTML tags are completely removed from the string, even if they are malformed or nested. The recommended approach is to repeatedly apply the regular expression replacement until no more matches are found, as described in the background. This ensures that all instances of tags are removed, regardless of how they are constructed. Alternatively, using a well-tested library like sanitize-html would be ideal, but since we are limited to editing only the provided code and cannot assume the ability to add new dependencies, we will implement the repeated replacement approach.

Specifically, in file core/js/gpt-core.js, on line 210, replace:

const query = sQuestion.replace(/<[^>]*>/g, '').replace(/google|Google/g, '').trim();

with:

let sanitized = sQuestion;
let previous;
do {
  previous = sanitized;
  sanitized = sanitized.replace(/<[^>]*>/g, '');
} while (sanitized !== previous);
const query = sanitized.replace(/google|Google/g, '').trim();

This change ensures that all HTML tags are removed, even if they are nested or malformed.

No new imports or dependencies are required.


Suggested changeset 1
core/js/gpt-core.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/core/js/gpt-core.js b/core/js/gpt-core.js
--- a/core/js/gpt-core.js
+++ b/core/js/gpt-core.js
@@ -207,7 +207,13 @@
   // Google That
   const keyword_google = 'google';
   const keyword_Google = 'Google';
-  const query = sQuestion.replace(/<[^>]*>/g, '').replace(/google|Google/g, '').trim();
+  let sanitized = sQuestion;
+  let previous;
+  do {
+    previous = sanitized;
+    sanitized = sanitized.replace(/<[^>]*>/g, '');
+  } while (sanitized !== previous);
+  const query = sanitized.replace(/google|Google/g, '').trim();
 
   let googleContents; 
   if (sQuestion.includes(keyword_google) || sQuestion.includes(keyword_Google)) {
EOF
@@ -207,7 +207,13 @@
// Google That
const keyword_google = 'google';
const keyword_Google = 'Google';
const query = sQuestion.replace(/<[^>]*>/g, '').replace(/google|Google/g, '').trim();
let sanitized = sQuestion;
let previous;
do {
previous = sanitized;
sanitized = sanitized.replace(/<[^>]*>/g, '');
} while (sanitized !== previous);
const query = sanitized.replace(/google|Google/g, '').trim();

let googleContents;
if (sQuestion.includes(keyword_google) || sQuestion.includes(keyword_Google)) {
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants