fix(security): address 4 CodeQL warnings#29
Merged
Conversation
Resolves four of the five CodeQL findings surfaced when default code scanning was enabled. The fifth (js/tainted-format-string in countdown-widget.js) is dismissed as false-positive — V8 does not reinterpret %s in JS template literals. - src/lib/celeste-widget.js: generateSessionId() now uses crypto.randomUUID() instead of Math.random(). Fixes js/insecure-randomness. Backward-compatible: sessionId is set in the constructor and not parsed downstream, only logged/routed. - examples/components/websocket-manager.html: log() now builds child spans with textContent instead of innerHTML, so incoming WebSocket frames can't inject markup into the demo log. Fixes js/xss-through-dom. - examples/components/png-export.html: pinned html2canvas script now carries an SRI hash (sha384) and crossorigin="anonymous", matching the SRI guidance we publish for consumers in docs/CDN_CONSUMPTION.md. Fixes js/functionality-from-untrusted-source. - .github/workflows/checks.yml: declare permissions: contents:read at the job level. The workflow only needs to read repo contents (checkout + npm install + build + test); the default GITHUB_TOKEN with broad write scope is gratuitously permissive in a public package. Fixes actions/missing-workflow-permissions. 166/166 tests still pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
corrupted-theme | e816abc | Commit Preview URL Branch Preview URL |
May 25 2026, 10:27 PM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves four of the five CodeQL findings surfaced when default code scanning was enabled on the repo. The fifth was dismissed in the GitHub UI as a false positive (see Dismissed below).
Fixes
src/lib/celeste-widget.jsjs/insecure-randomnessgenerateSessionId()usescrypto.randomUUID()instead ofMath.random(). Backward-compatible — sessionId is set in the constructor, only used for logging/routing.examples/components/websocket-manager.htmljs/xss-through-domlog()builds child spans withtextContentinstead ofinnerHTML. Incoming WebSocket frames can no longer inject markup into the demo log.examples/components/png-export.htmljs/functionality-from-untrusted-sourceintegrity=sha384-...+crossorigin="anonymous"on the pinned html2canvas script. Matches the SRI guidance we publish for consumers indocs/CDN_CONSUMPTION.md..github/workflows/checks.ymlactions/missing-workflow-permissionspermissions: contents: read. The workflow only needs to read repo contents — the default broad-writeGITHUB_TOKENis gratuitously permissive in a public package.Dismissed (not fixed)
js/tainted-format-string—src/lib/countdown-widget.js:195— dismissed asfalse_positive. The flagged line isconsole.error(\...${eventName}...`, error). JS template literals are not printf-style format strings — V8 doesn't reinterpret%sinside ``...${x}...` ``. This rule is a known false-positive on JS template-literal interpolation. Real impact is bounded to log injection via newline chars in the browser dev console, with no exploitation path.Verification
node --checkclean on changed JSsha384-ZZ1pncU3bQe8y31yfZdMFdSpttDoPmOZg2wguVK9almUodir1PghgT0eY7Mrty8HTest plan
checksjob runs with read-only token without breaking🤖 Generated with Claude Code