Security: fix CodeQL alerts #22
Merged
+38
−5
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull request overview
This PR aims to address CodeQL security alerts by tightening GitHub Actions permissions, adding Subresource Integrity (SRI) metadata to externally loaded scripts, and refactoring address parsing to avoid potentially unsafe regex behavior.
Changes:
- Added
integrity,crossorigin, andreferrerpolicyattributes to CDN-loadedbabel-polyfillscripts in the manual HTML pages. - Reduced GitHub Actions job token permissions by explicitly setting least-privilege
permissionsin CI workflows. - Refactored
colCache.decodeExparsing logic to avoid the prior regex-based split.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
spec/manual/public/index.min.html |
Adds SRI + CORS/referrer policy attributes for the CDN script. |
spec/manual/public/index.html |
Adds SRI + CORS/referrer policy attributes for the CDN script. |
lib/utils/col-cache.js |
Refactors decodeEx parsing logic to avoid regex. |
.github/workflows/tests.yml |
Restricts job token permissions to contents: read. |
.github/workflows/asset-size.yml |
Restricts job token permissions and allows PR commenting (pull-requests: write). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
aleksei-semikozov
force-pushed
the
security-fix
branch
from
a64e0be to
6b75c7b
Compare
Tucchhaa
approved these changes
Jan 23, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
…tributes
Summary
Test plan
Related to source code (for typings update)