From 0e815d63e11a73a1f3eb9998c8e6e0f9b4fd7ad3 Mon Sep 17 00:00:00 2001 From: Chih-Yu Yeh Date: Fri, 30 Oct 2026 14:57:27 +0800 Subject: [PATCH 1/2] Potential fix for code scanning alert no. 1: Incomplete URL substring sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- tests/test_app.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/test_app.py b/tests/test_app.py index 15c8532..d5a5176 100644 --- a/tests/test_app.py +++ b/tests/test_app.py @@ -531,7 +531,11 @@ def test_a_model_the_page_does_not_support_says_why_and_offers_a_github_issue_fi assert query["title"] == [title] and asks in body assert "`meta-llama/Llama-3.2-1B-Instruct`" in body and "https://huggingface.co/meta-llama/Llama-3.2-1B-Instruct" in body and "`llama`" in body assert "localhost" not in button.proto.url # never the server's address, which may be a private one - [invite] = [m.value for m in at.markdown if "github.com" in m.value] + [invite] = [ + m.value + for m in at.markdown + if (urlsplit(m.value).hostname in {"github.com"} or (urlsplit(m.value).hostname or "").endswith(".github.com")) + ] assert f"{page.ISSUES_URL}?q=is%3Aissue%20llama" in invite # a search for one someone opened already if locale == "en-US": assert not CJK.search(button.label + title + body + invite) From f48d949311d78a8f53a651bb8a02dc2d20cb0ba8 Mon Sep 17 00:00:00 2001 From: Jimmy Yeh Date: Fri, 30 Oct 2026 15:04:22 +0800 Subject: [PATCH 2/2] Fix GitHub invitation lookup in the page tests Extract Markdown link destinations before validating their GitHub hostnames. The invitation is a paragraph in both languages, so parsing the whole value as a URL discarded it and failed the page test. --- tests/test_app.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/test_app.py b/tests/test_app.py index d5a5176..3270806 100644 --- a/tests/test_app.py +++ b/tests/test_app.py @@ -534,7 +534,10 @@ def test_a_model_the_page_does_not_support_says_why_and_offers_a_github_issue_fi [invite] = [ m.value for m in at.markdown - if (urlsplit(m.value).hostname in {"github.com"} or (urlsplit(m.value).hostname or "").endswith(".github.com")) + if any( + (host := urlsplit(link).hostname or "") == "github.com" or host.endswith(".github.com") + for link in re.findall(r"\[[^\]]*\]\(([^)]+)\)", m.value) + ) ] assert f"{page.ISSUES_URL}?q=is%3Aissue%20llama" in invite # a search for one someone opened already if locale == "en-US":