Skip to content

Fix regex security hotspot in brand.html; deduplicate theme-toggle markup#25

Merged
kiyarose merged 2 commits into
mainfrom
copilot/fix-regex-security-hotspots
Mar 20, 2026
Merged

Fix regex security hotspot in brand.html; deduplicate theme-toggle markup#25
kiyarose merged 2 commits into
mainfrom
copilot/fix-regex-security-hotspots

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Mar 20, 2026 •
edited
Loading

Two issues: a static-analysis ReDoS warning on a regex in brand.html, and the theme-toggle <button> SVG block duplicated verbatim across all four HTML pages.

Regex (brand.html)

highlightHtml() used a lazy quantifier [^&]*? that scanners flag for potential ReDoS. The regex only ever runs on the output of makeHtml() — bounded, machine-generated strings, never user input — so catastrophic backtracking is not a realistic concern. Changed to greedy [^&]* (correct and more idiomatic here) and added a comment making the input provenance explicit.

// Before
/(&lt;\/?[a-zA-Z0-9-]+)([^&]*?)(&gt;)/g

// After — greedy [^&]* is correct; no nested quantifiers, no backtracking risk
/(&lt;\/?[a-zA-Z0-9-]+)([^&]*)(&gt;)/g

Deduplicated theme-toggle markup

The 38-line <button class="theme-toggle"> block (inline sun/moon SVGs) was copy-pasted into index.html, apply.html, donate.html, and brand.html. Moved to theme.js as injectThemeToggleButton(), called from init() when #themeToggle is absent.

  • theme.js — adds injectThemeToggleButton(); init() now injects the button if not already in the DOM
  • All four HTML files — hardcoded button block removed, replaced with a one-line comment
  • donate.html's override script (shake-instead-of-toggle behavior) is unaffected; it runs after theme.js injects the element and clones it as before

Net: −157 lines of duplication across HTML, +40 lines in theme.js.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

@deepsource-io
Copy link
Copy Markdown
Contributor

deepsource-io Bot commented Mar 20, 2026 •
edited
Loading

DeepSource Code Review

We reviewed changes in d2b6350...70f99c8 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade   Security  

Reliability  

Complexity  

Hygiene  

Code Review Summary

Analyzer Status Updated (UTC) Details
Secrets Mar 20, 2026 5:28p.m. Review ↗
Shell Mar 20, 2026 5:28p.m. Review ↗
JavaScript Mar 20, 2026 5:28p.m. Review ↗

@kiyarose
fix: address regex security hotspot in brand.html and deduplicate the…
70f99c8 
…me-toggle markup

- brand.html: change lazy quantifier [^&]*? to greedy [^&]* in highlightHtml
  regex; add comment noting input is machine-generated (not user input) so ReDoS
  is not a concern
- theme.js: add injectThemeToggleButton() so the button is defined in one place;
  init() now injects it automatically when #themeToggle is absent
- index.html, apply.html, donate.html, brand.html: remove 38-line duplicated
  theme-toggle <button> block from each file (replaced with a brief comment)

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SillyLittleTech/lander/sessions/d607b3be-436a-4aac-9f9f-13f8be74a195
@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented Mar 20, 2026 •
edited
Loading

Deploying kvgrow with  Cloudflare Pages  Cloudflare Pages

Latest commit: 70f99c8
Status: ✅  Deploy successful!
Preview URL: https://84d76411.kvgrow.pages.dev
Branch Preview URL: https://copilot-fix-regex-security-h.kvgrow.pages.dev

View logs

Copilot AI changed the title [WIP] Fix security hotspots in brand.html and reduce code duplication Fix regex security hotspot in brand.html; deduplicate theme-toggle markup Mar 20, 2026
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Mar 20, 2026 •
edited
Loading

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot AI requested a review from kiyarose March 20, 2026 17:29
@kiyarose kiyarose added this to the Modernize_r1 milestone Mar 20, 2026
@kiyarose kiyarose added enhancement New feature or request good first issue Good for newcomers labels Mar 20, 2026
@kiyarose kiyarose marked this pull request as ready for review March 20, 2026 17:45
Copilot AI review requested due to automatic review settings March 20, 2026 17:45
Copilot AI reviewed Mar 20, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@kiyarose kiyarose merged commit 16ab410 into main Mar 20, 2026
5 checks passed
@kiyarose kiyarose deleted the copilot/fix-regex-security-hotspots branch March 20, 2026 17:47
kiyarose added a commit that referenced this pull request Mar 29, 2026
@kiyarose
@deepsource-autofix @cursoragent
Merge changes from main into donation page layout update branch (#39)
f867880 
* donate: follow system theme instead of forcing dark mode (#21)

* Initial plan

* fix: follow system theme on donate page instead of forcing dark mode

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* style: format code with Prettier and StandardJS

This commit fixes the style issues introduced in 04d1db2 according to the output
from Prettier and StandardJS.

Details: #21

* fix: head script uses only system theme, no localStorage, on donate page

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>
Co-authored-by: Kiya Rose Ren-Miyakari <kiya.rose@sillylittle.tech>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>

* Switch primary font to Lexend and refine typography weights (#22)

* Switch primary font to Lexend and keep footer in SLF Dreamer

Co-authored-by: Kiya Rose Ren-Miyakari <kiya.rose@sillylittle.tech>

* Increase button font weight and lighten Tech wordmark

Co-authored-by: Kiya Rose Ren-Miyakari <kiya.rose@sillylittle.tech>

* style: format code with Prettier and StandardJS

This commit fixes the style issues introduced in 3e8c457 according to the output
from Prettier and StandardJS.

Details: #22

* Move Google Fonts to `<link>` preconnect and fix "Tech" wordmark font (#24)

* Initial plan

* perf: move Google Fonts to link preconnect and fix Tech wordmark font

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>

* docs: add comment to base.css noting Lexend must be loaded via link in HTML head

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>
Co-authored-by: Kiya Rose Ren-Miyakari <kiya.rose@sillylittle.tech>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Fix regex security hotspot in brand.html; deduplicate theme-toggle markup (#25)

* Initial plan

* fix: address regex security hotspot in brand.html and deduplicate theme-toggle markup

- brand.html: change lazy quantifier [^&]*? to greedy [^&]* in highlightHtml
  regex; add comment noting input is machine-generated (not user input) so ReDoS
  is not a concern
- theme.js: add injectThemeToggleButton() so the button is defined in one place;
  init() now injects it automatically when #themeToggle is absent
- index.html, apply.html, donate.html, brand.html: remove 38-line duplicated
  theme-toggle <button> block from each file (replaced with a brief comment)

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SillyLittleTech/lander/sessions/d607b3be-436a-4aac-9f9f-13f8be74a195

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>

* Create dependabot.yml for version updates

Add initial configuration for Dependabot updates.

* Fix copy button hidden behind codebox on brand page (#29)

* Initial plan

* Fix: Move copy button inside codebox to fix visibility on brand page

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SillyLittleTech/lander/sessions/95786c2e-8426-4962-9e32-0a5d8b95169d

* Fix copy button: solid background, outside scroll container, clean up duplicate CSS rule

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SillyLittleTech/lander/sessions/a3f820f0-13cd-462d-99b7-6f488c044450

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>

* Set package ecosystem to 'npm' in dependabot config

* Fix FOUC on Contact Us page and resolve SonarCloud maintainability warnings (#31)

* Initial plan

* Fix: add anti-FOUC theme script to apply.html head

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SillyLittleTech/lander/sessions/a98d089c-ab11-4c4b-a4fa-7650d3896cd8

* Fix SonarCloud empty catch block warning in anti-FOUC scripts

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SillyLittleTech/lander/sessions/6f4b51b7-2269-4f71-ae73-973284fcaffc

* Fix SonarCloud unused catch binding in anti-FOUC scripts (use optional catch binding)

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SillyLittleTech/lander/sessions/a28f3a6f-996a-4016-8937-3b1ac822baa6

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>

* fix: resolve 53 SonarCloud code smells across 6 files (#27)

* Initial plan

* fix: resolve 53 SonarCloud code smells across brand.css, brand.html, donate.html, index.html, script.js, theme.js

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SillyLittleTech/lander/sessions/c16e496a-1317-4d1b-8e22-e77d44847609

* Changes before error encountered

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SillyLittleTech/lander/sessions/6ab0c607-d2b4-4328-b631-5e9ab7d8bab2

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>

* Add package.json listing all project dependencies (#32)

Agent-Logs-Url: https://github.com/SillyLittleTech/lander/sessions/4be40485-ef5d-4df0-a8f7-ba0e3df5456a

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>

* Create CNAME

* Delete CNAME

* Replace contributor links with Projects page; add floating contributor profile icons (#36)

* Initial plan

* Modernize links: add projects link, contributor profile icons

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SillyLittleTech/lander/sessions/a574598b-7edf-4eb0-aa1e-5a759150361d

* Move contributor icons to contributors.json, load dynamically

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>
Agent-Logs-Url: https://github.com/SillyLittleTech/lander/sessions/dfe39997-dff4-4df4-a515-5832beec1d91

* Move contributor icons above links in right section

Agent-Logs-Url: https://github.com/SillyLittleTech/lander/sessions/c06585fb-4ad8-402f-bfbe-eb9b2a46e50c

Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kiyarose <75678535+kiyarose@users.noreply.github.com>

* enhance: better terminology on apply page (#37)

Apply page now better serves as a versatile contact us page.
The terminology on this page now better serves any possible reason for contact, and is welcoming to projects of all types.

* Update redirects and apply page header (#38)

* Update _redirects with new project links

Added new redirects for various projects and contributions.

* Update title and header for apply.html

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: deepsource-autofix[bot] <62050782+deepsource-autofix[bot]@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

+1 more reviewer

@kiyarose kiyarose kiyarose approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@kiyarose kiyarose

Copilot code review Copilot

Labels

enhancement New feature or request good first issue Good for newcomers

Projects

None yet

Milestone

Modernize_r1

Development

Successfully merging this pull request may close these issues.

3 participants

@kiyarose