From 63576e86aa035dfa8580a001f0e76659dfb9b0fe Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 19 Sep 2026 16:57:57 +0000 Subject: [PATCH 1/2] Bump actions/checkout from 5.1.0 to 7.0.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 5.1.0 to 7.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09...3d3c42e5aac5ba805825da76410c181273ba90b1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/pr-test-package.yml | 2 +- .github/workflows/validate-workflows.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index af64181..ea70f53 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,7 +20,7 @@ jobs: steps: - name: Check out repository - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 8aa06ab..cceddf4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Check out repository - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/pr-test-package.yml b/.github/workflows/pr-test-package.yml index f1750f1..ee4f9e5 100644 --- a/.github/workflows/pr-test-package.yml +++ b/.github/workflows/pr-test-package.yml @@ -18,7 +18,7 @@ jobs: if: github.event.label.name == 'test-build' runs-on: ubuntu-latest steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.event.pull_request.head.sha }} persist-credentials: false diff --git a/.github/workflows/validate-workflows.yml b/.github/workflows/validate-workflows.yml index 0b0cc02..a0139eb 100644 --- a/.github/workflows/validate-workflows.yml +++ b/.github/workflows/validate-workflows.yml @@ -15,7 +15,7 @@ jobs: actionlint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install verified actionlint From 21b0001b3ab7d427dab66cba2b117437093b2a60 Mon Sep 17 00:00:00 2001 From: Alexander Phillips Date: Sat, 19 Sep 2026 13:08:03 -0400 Subject: [PATCH 2/2] Fix browser fixture CodeQL findings and update checkout action --- .github/workflows/ci.yml | 1 + tests/browser_fixture.cjs | 12 ++++++++++++ tests/browser_fixture_test.cjs | 26 ++++++++++++++++++++++++++ tests/i18n_layout.cjs | 6 +++--- tests/maintenance_ui.cjs | 5 +++-- tests/theme_ui.cjs | 5 +++-- 6 files changed, 48 insertions(+), 7 deletions(-) create mode 100644 tests/browser_fixture.cjs create mode 100644 tests/browser_fixture_test.cjs diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ea70f53..dbe2465 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -61,6 +61,7 @@ jobs: run: | npm install --prefix "$RUNNER_TEMP/acp-browser" --no-save --ignore-scripts playwright@1.63.0 jquery@3.7.1 "$RUNNER_TEMP/acp-browser/node_modules/.bin/playwright" install --with-deps chromium + ACP_BROWSER_MODULES="$RUNNER_TEMP/acp-browser/node_modules" node tests/browser_fixture_test.cjs ACP_BROWSER_MODULES="$RUNNER_TEMP/acp-browser/node_modules" node tests/theme_ui.cjs ACP_BROWSER_MODULES="$RUNNER_TEMP/acp-browser/node_modules" node tests/maintenance_ui.cjs diff --git a/tests/browser_fixture.cjs b/tests/browser_fixture.cjs new file mode 100644 index 0000000..770d3bc --- /dev/null +++ b/tests/browser_fixture.cjs @@ -0,0 +1,12 @@ +// Prepare trusted repository fixtures, not arbitrary/untrusted HTML. Preserve +// inline configuration while loading external scripts and styles explicitly. +async function setFixtureContent(page, html) { + const documentHtml = await page.evaluate(markup => { + const doc = new DOMParser().parseFromString(markup, 'text/html'); + doc.querySelectorAll('script[src], link').forEach(element => element.remove()); + return '' + doc.documentElement.outerHTML; + }, html); + await page.setContent(documentHtml); +} + +module.exports = {setFixtureContent}; diff --git a/tests/browser_fixture_test.cjs b/tests/browser_fixture_test.cjs new file mode 100644 index 0000000..9e645dd --- /dev/null +++ b/tests/browser_fixture_test.cjs @@ -0,0 +1,26 @@ +const assert = require('node:assert/strict'); +const path = require('node:path'); +const dependency = name => process.env.ACP_BROWSER_MODULES ? path.join(process.env.ACP_BROWSER_MODULES, name) : name; +const {chromium} = require(dependency('playwright')); +const {setFixtureContent} = require('./browser_fixture.cjs'); + +(async () => { + const browser = await chromium.launch({headless:true}); + try { + const page = await browser.newPage(); + const requests = []; + await page.route('**/*', route => { requests.push(route.request().url()); return route.abort(); }); + await setFixtureContent(page, ` + + +
Fixture content
`); + assert.equal(await page.locator('script[src], link').count(), 0); + assert.equal(await page.evaluate(() => window.fixtureConfig.value), 'inline configuration retained'); + assert.equal(await page.locator('#fixture').textContent(), 'Fixture content'); + assert.equal(await page.evaluate(() => document.compatMode), 'CSS1Compat'); + assert.deepEqual(requests, [], 'Fixture assets must not be requested before explicit injection'); + console.log('browser_fixture: DOM preparation handles alternate tag syntax and preserves inline configuration.'); + } finally { await browser.close(); } +})().catch(error => { console.error(error); process.exitCode = 1; }); diff --git a/tests/i18n_layout.cjs b/tests/i18n_layout.cjs index 7a1d116..af0d1e6 100644 --- a/tests/i18n_layout.cjs +++ b/tests/i18n_layout.cjs @@ -3,6 +3,7 @@ const path = require('node:path'); const fs = require('node:fs'); const {execFileSync} = require('node:child_process'); +const {setFixtureContent} = require('./browser_fixture.cjs'); const assert = require('node:assert/strict'); const modules = process.env.ACP_BROWSER_MODULES; const dependency = name => modules ? path.join(modules, name) : name; @@ -15,13 +16,12 @@ const locales = JSON.parse(fs.readFileSync(path.join(plugin, 'locales/locales.js const browser = await chromium.launch({headless:true}); try { for (const [locale, definition] of Object.entries(locales)) { - const html = execFileSync('php', [path.join(__dirname, 'render_i18n_page.php'), locale], {encoding:'utf8', maxBuffer:4e6}) - .replace(/