Rewrite escape/unescape for SQL#1245
Draft
ukrbublik wants to merge 5 commits into
Draft
Conversation
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders Open Preview |
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
|
This pull request is automatically built and testable in CodeSandbox. To see build info of the built libraries, click here or the icon next to each commit SHA. Latest deployment of this branch, based on commit df97ffd:
|
ukrbublik
force-pushed
the
alert-autofix-10
branch
from
April 29, 2025 09:16
cc3d619 to
566572b
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // escape \ -> \\\\ | ||
| res = res.replace(/(\\\\)/g, "\\\\$&"); | ||
| // escape % and _ with \ | ||
| res = res.replace(/[%_]/g, "\\$&"); |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #1245 +/- ##
==========================================
- Coverage 79.62% 8.05% -71.58%
==========================================
Files 246 246
Lines 13145 13312 +167
Branches 1743 1749 +6
==========================================
- Hits 10467 1072 -9395
- Misses 1800 12230 +10430
+ Partials 878 10 -868 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
ukrbublik
changed the title
ukrbublik
force-pushed
the
alert-autofix-10
branch
from
May 9, 2025 14:34
1ae4589 to
f3082b7
Compare
ukrbublik
force-pushed
the
alert-autofix-10
branch
from
May 12, 2025 22:35
f3082b7 to
6b5c131
Compare
ukrbublik
force-pushed
the
alert-autofix-10
branch
from
May 16, 2025 14:48
6b5c131 to
f0003b9
Compare
ukrbublik
force-pushed
the
alert-autofix-10
branch
from
May 23, 2025 00:00
f0003b9 to
1638ea8
Compare
ukrbublik
force-pushed
the
alert-autofix-10
branch
from
July 19, 2025 10:03
1638ea8 to
16828b7
Compare
|
Deployment failed with the following error: |
…ing or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This reverts commit 566572b.
ukrbublik
force-pushed
the
alert-autofix-10
branch
from
July 19, 2025 10:42
16828b7 to
df97ffd
Compare
|
Deployment failed with the following error: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/ukrbublik/react-awesome-query-builder/security/code-scanning/10
To fix the issue, we need to ensure that backslashes are properly escaped in the default branch of the
escapeLikefunction. This can be achieved by modifying the regular expression in theres.replacecall on line 40 to include backslashes (\\) as part of the characters to escape. The replacement string should also escape backslashes correctly.The updated regular expression will be
/[%_\\]/g, and the replacement string will be"\\\\$&". This ensures that all occurrences of%,_, and\are escaped consistently.Suggested fixes powered by Copilot Autofix. Review carefully before merging.