Repository navigation
Fix code-scanning alerts #74-#76: Markdown cell escaping misses backslashes in the sweep scripts #2546
Description
Problem
Three high-severity CodeQL alerts are open on main, all js/incomplete-sanitization: "This does not escape backslash characters in the input." The same code is on v2/main.
| Alert | Location | Code |
|---|---|---|
| #74 | scripts/dependabot-alerts.mjs:435 |
const cell = (value) => String(value).replace(/|/g, "\|"); |
| #75 | scripts/dependabot-alerts.mjs:679 |
a.summary.replace(/|/g, "\|") |
| #76 | scripts/sdk-watch.mjs:442 |
const cell = (value) => String(value).replace(/|/g, "\|"); |
Each helper escapes | for a Markdown table cell but not \. A value ending in a backslash (for example abc\) yields abc\\| after escaping, which re-exposes the pipe and breaks the table row. The values include advisory summaries and upstream text, so they are not fully under our control. The impact is limited to the rendering of bot-filed issue bodies, but the alerts are real and will keep flagging every release PR.
Change
- Escape the backslash before the pipe (
.replace(/\\/g, "\\\\").replace(/\|/g, "\\|")), in one shared helper both scripts import rather than three copies. - Add a test case with a trailing backslash.
Acceptance
- Code scanning alerts Skip the dist/index.js bit #74, clarify readme #75 and Improve Windows Support #76 close
- One shared, tested cell-escaping helper in
scripts/lib/
Part of tracker #2543. Needs no credential; can start now.
Activity
cliffhall commentedon Sep 30, 2026
Triage: Priority Medium (total 7)
Board: #28, Status
Todo. Part of tracker #2543.fix(scripts): escape backslashes before pipes in sweep table cells (m…
style(scripts): prettier reflow after the cell() change (modelcontext…