feat: New admin setting for hiding user pages #10708
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
fix: Handle code changes that effect user page setting
| if (excludedPaths.length > 0) { | ||
| const escapedPaths = excludedPaths.map((p) => { | ||
| const cleanPath = p.startsWith('/') ? p.substring(1) : p; | ||
| return cleanPath.replace(/\//g, '\\/'); |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 days ago
General fix approach: when interpolating arbitrary strings into a regular expression pattern, escape them with a proper regex-escaping routine instead of ad-hoc replace calls. Here, leverage the already-imported escapeStringRegexp helper so that all regex metacharacters, including backslashes, are properly escaped. If we still need to treat / specially, we should do that on top of the generic escaping in a consistent way.
Best concrete fix: change the excludedPaths.map callback so that it uses escapeStringRegexp(cleanPath) rather than manually replacing / with \/. Since escapeStringRegexp escapes all regex metacharacters but does not require us to escape / itself (because the pattern is provided as a string literal to new RegExp rather than /.../ syntax), we do not need the manual replace at all. The resulting code will safely handle backslashes and any other special characters in excludedPaths. This change is entirely local to the escapedPaths computation and preserves the logic of the RegExp construction and the query.and condition.
Specifically, in packages/remark-lsx/src/server/routes/list-pages/index.ts, in the if (excludedPaths.length > 0) block around lines 95–101, replace the body of the map so that:
cleanPathis still computed as before to strip a leading slash.- The return statement calls
escapeStringRegexp(cleanPath)instead ofcleanPath.replace(/\//g, '\\/').
No new imports or additional helpers are needed; escapeStringRegexp is already imported at the top of the file.
| @@ -95,7 +95,7 @@ | ||
| if (excludedPaths.length > 0) { | ||
| const escapedPaths = excludedPaths.map((p) => { | ||
| const cleanPath = p.startsWith('/') ? p.substring(1) : p; | ||
| return cleanPath.replace(/\//g, '\\/'); | ||
| return escapeStringRegexp(cleanPath); | ||
| }); | ||
|
|
||
| const regex = new RegExp(`^\\/(${escapedPaths.join('|')})(\\/|$)`); |
|
https://github.com/copilot/c/aeec533e-bebd-445e-a393-3dae2b5237f6 |
R1