Repository navigation
fix(ci): scan Vue/Svelte/Astro/Go files as code, not as disguised payloads - #212
Merged
Merged
Conversation
…loads The disguised-code rule flags JavaScript inside a file whose extension isn't a known code type. .vue single-file components legitimately contain <script> blocks, so docforum-core #207 was blocked by a false positive. Add vue, svelte, astro, less, sass, go, mod and sum to the text/code extension list; every line rule still runs on them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
freebuff-web Bot
pushed a commit
to shekwolonathanielbala-cyber/docforum-core
that referenced
this pull request
Oct 21, 2026
conflicts (discovery, i18n, property tests) Upstream main moved from ffff7fd to a6c730b — four PRs: DocForum#210 specialty discovery + search, DocForum#205/DocForum#133 server-side i18n, DocForum#209 property tests, DocForum#212 malware-scan file types. Three conflicts, all in shared files: - `backend/prisma/schema.prisma`: `User` gains upstream's `locale` column (i18n) next to `emailVerifiedAt`, kept in the file's column alignment. The matching migrations (`20261021090000_doctor_discovery_trigram_search`, `20261021100000_user_locale`) arrive with the merge, in order. - `ROADMAP.md`: the Phase 2 DocForum#4 and DocForum#23 lines collided (this branch ticks DocForum#4 done, upstream ticks DocForum#23 discovery done) — both ticks kept, and this branch's Phase 2 status line is updated to "DocForum#3, DocForum#4 and DocForum#23 done" so it doesn't contradict them. - `docs/api/README.md`: upstream's new rows (`PUT /doctors/me/specialties`, the Accept-Language note on signup) are kept with this branch's escaped-pipe table rows, because upstream's versions of the surrounding rows carry unescaped `|` inside inline code, which splits the markdown table. `backend/src/app.ts` auto-merged correctly: `/specialties` is mounted while this branch's split consultation routers (`/appointments/:id/consultation` + `/consultations`) survive intact. Environment note for anyone reproducing: DocForum#205 adds deps (`intl-messageformat`, `fast-check`), so `npm ci` + `prisma generate` must be re-run after pulling; a stale node_modules shows up as "Cannot find module 'intl-messageformat'" and "no exported member 'PrismaClient'". Verified after the merge: `prisma validate` + `generate`, `tsc --noEmit`, `npm run build`, `npm run i18n:check`, unit suite 149/149 (20 files, including the new property tests), full integration suite 19 files / 258 tests green in parallel.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The malware scan's
disguised-coderule fires when a file whose extension isn't a known code type contains JavaScript. That catches payloads hidden as fonts or images, like the one in escrow #163. But.vuesingle-file components legitimately contain<script>blocks, so docforum-core #207 (docs/site/api/ApiReference.vue) was flagged HIGH, and becauseMalware scanis a required check, it was blocked.Change:
vue,svelte,astro,less,sass,go,modandsumare added to the scanner's code/text extension list. These files are still scanned by every line rule (pipe-to-shell, exfiltration endpoints, decode-and-run and so on); they're just no longer treated as "this shouldn't contain code". Real media files (fonts, images, archives,.wasm) are unchanged.Tested with the scanner harness against live PRs:
high=1 [disguised-code], afterhigh=0.pull_request_targetruns the scanner frommain, so this takes effect once merged. I'll then re-scan core #207 with the backfill.🤖 Generated with Claude Code