fix(worker)!: remove dead highlight-load-lang code path by marcoscaceres · Pull Request #5198 · speced/respec

marcoscaceres · 2026-04-13T22:19:35Z

Summary

Removes the unused highlight-load-lang action from the worker
This code path has been dead since the highlight system was refactored (see Example 134: Load custom syntax highlighting language seems obselete #4934)
The Copilot Autofix that tried to add URL origin validation was broken in blob workers (self.location.origin is "null"), so removing the dead code is the correct fix

Test plan

~~Modified Web platform tests~~ — no observable behavior change (dead code removal)

marcoscaceres · 2026-04-14T02:59:38Z

@copilot see the CI error about the commit message. Can you fix that please?

Copilot · 2026-04-14T03:05:05Z

@copilot see the CI error about the commit message. Can you fix that please?

Done in commit 9faf188. The CI check (action-semantic-pull-request) validates the PR title, not the individual commit messages. The new commit uses fix(worker): validate URL origin before importScripts in highlight-load-lang as the message. The PR title will also need to be updated to a conventional commit format (e.g., fix(worker): validate URL origin before importScripts in highlight-load-lang) for the CI check to pass.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh gh auth status (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

marcoscaceres · 2026-04-14T14:20:25Z

@copilot Can you fix the lint error from ci?

Copilot · 2026-04-14T14:23:09Z

@copilot Can you fix the lint error from ci?

Fixed in commit d7c435c. The two Prettier formatting issues were long lines that needed to be broken up — the multi-condition if statement and the long error message string.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

…ad-lang Co-authored-by: marcoscaceres <870154+marcoscaceres@users.noreply.github.com>

Agent-Logs-Url: https://github.com/speced/respec/sessions/eaf97df3-cfd4-4999-92cf-047f0b3b3ca4 Co-authored-by: marcoscaceres <870154+marcoscaceres@users.noreply.github.com>

The highlight-load-lang action is unused by production code (see #4934). The same-origin check added by Copilot Autofix was broken in blob workers (self.location.origin is "null"), silently breaking the only remaining consumer. Remove the dead code instead of hardening it.

Copilot

Pull request overview

This PR updates the ReSpec web worker script with the goal of addressing a security finding around importScripts() usage in the highlighting worker.

Changes:

Bumps the worker version header comment to v1.1.0.
Simplifies the worker message handler to only process the "highlight" action (removing the "highlight-load-lang" branch).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

marcoscaceres · 2026-04-17T17:25:43Z

@copilot can you check and fix the ci issues?

Agent-Logs-Url: https://github.com/speced/respec/sessions/78a14774-8331-43c0-b95e-83e38a6bd570 Co-authored-by: marcoscaceres <870154+marcoscaceres@users.noreply.github.com>

Copilot · 2026-04-17T17:28:02Z

@copilot can you check and fix the ci issues?

Fixed in commit 54686e5. The Karma unit test "highlights remote languages not bundled by default with ReSpec" was failing because it exercised the highlight-load-lang handler that was intentionally removed. I removed the failing test along with its now-unused fixtures (tests/spec/core/highlight.html and tests/support-files/hljs-testlang.js).

marcoscaceres · 2026-04-18T00:48:54Z

@copilot rebase

# Conflicts: # tests/spec/core/highlight.html # worker/respec-worker.js Co-authored-by: marcoscaceres <870154+marcoscaceres@users.noreply.github.com>

Copilot · 2026-04-18T00:52:49Z

@copilot rebase

Done in commit 645ac27. The branch is now merged with the latest main (f351bbb). I resolved the conflicts by keeping our dead-code removal in worker/respec-worker.js and the test fixture deletion.

marcoscaceres · 2026-04-18T02:18:40Z

Merging this as a hot fix, as it doesn't touch any code, but addresses the CI issue.

marcoscaceres · 2026-04-18T02:20:43Z

oh, no, wait!... it does touch code. I misread it on my phone.

… optional chain - Remove Object.assign clone (structured clone already provides fresh data) - Early return for non-highlight actions (don't echo unknown messages) - Add optional chain on data.languages for robustness

Copilot

Pull request overview

This PR removes a long-dead worker message/action (highlight-load-lang) from ReSpec’s syntax-highlighting worker, along with the associated test fixture that exercised that path.

Changes:

Remove the "highlight-load-lang" message handler from worker/respec-worker.js, leaving the worker to handle only "highlight" requests.
Delete the test HTML/fixture JS that posted "highlight-load-lang" to the worker.
Drop the spec test that asserted remote/custom language loading via that removed action.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
worker/respec-worker.js	Deletes the dead `"highlight-load-lang"` branch and simplifies the message handler to only process `"highlight"`.
tests/support-files/hljs-testlang.js	Removes the now-unused custom highlight language fixture.
tests/spec/core/highlight.html	Removes the spec fixture document that posted `"highlight-load-lang"` to the worker.
tests/spec/core/highlight-spec.js	Removes the spec test that depended on `"highlight-load-lang"` to register a remote language.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

marcoscaceres · 2026-04-18T03:36:07Z

@sidvishnoi this one is high priority — it removes the flaky CDN highlight test that's failing CI on 4+ other PRs. Clean dead code removal (per #4934). Would appreciate a quick look when you get a chance.

sidvishnoi

LGTM. Marked as breaking change (!) in PR title.

Merge latest main which removes dead highlight-load-lang code path (#5198). The highlight.html fixture that our branch updated to use document.respec.worker has been deleted on main as dead code. Co-authored-by: marcoscaceres <870154+marcoscaceres@users.noreply.github.com>

Copilot started work on behalf of marcoscaceres April 14, 2026 02:59 View session

Copilot finished work on behalf of marcoscaceres April 14, 2026 03:05

marcoscaceres changed the title ~~Potential fix for code scanning alert no. 24: Client-side URL redirect~~ fix: code scanning alert no. 24: Client-side URL redirect Apr 14, 2026

marcoscaceres changed the title ~~fix: code scanning alert no. 24: Client-side URL redirect~~ fix(worker): validate URL origin before importScripts Apr 14, 2026

Copilot started work on behalf of marcoscaceres April 14, 2026 14:20 View session

Copilot finished work on behalf of marcoscaceres April 14, 2026 14:24

marcoscaceres marked this pull request as ready for review April 15, 2026 09:02

marcoscaceres and others added 4 commits April 17, 2026 17:55

Potential fix for code scanning alert no. 24: Client-side URL redirect

f0a6b7b

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

fix(worker): validate URL origin before importScripts in highlight-lo…

da4150c

…ad-lang Co-authored-by: marcoscaceres <870154+marcoscaceres@users.noreply.github.com>

fix(worker): fix prettier formatting in respec-worker.js

a3c4815

Agent-Logs-Url: https://github.com/speced/respec/sessions/eaf97df3-cfd4-4999-92cf-047f0b3b3ca4 Co-authored-by: marcoscaceres <870154+marcoscaceres@users.noreply.github.com>

marcoscaceres force-pushed the alert-autofix-24 branch from 2799fd9 to c9a2e1c Compare April 17, 2026 08:21

marcoscaceres requested a review from Copilot April 17, 2026 08:22

Copilot started reviewing on behalf of marcoscaceres April 17, 2026 08:23 View session

Copilot AI reviewed Apr 17, 2026

View reviewed changes

Comment thread worker/respec-worker.js Outdated

Comment thread worker/respec-worker.js Outdated

marcoscaceres changed the title ~~fix(worker): validate URL origin before importScripts~~ fix(worker): remove dead highlight-load-lang code path Apr 17, 2026

Merge branch 'main' into alert-autofix-24

f12ff42

Copilot started work on behalf of marcoscaceres April 17, 2026 17:25 View session

fix(tests): remove dead highlight-load-lang test and fixtures

54686e5

Agent-Logs-Url: https://github.com/speced/respec/sessions/78a14774-8331-43c0-b95e-83e38a6bd570 Co-authored-by: marcoscaceres <870154+marcoscaceres@users.noreply.github.com>

Copilot finished work on behalf of marcoscaceres April 17, 2026 17:29

chore(worker): drop manual version comment (not consumed anywhere)

b094c5c

Copilot started work on behalf of marcoscaceres April 18, 2026 00:49 View session

Merge remote-tracking branch 'origin/main' into alert-autofix-24

645ac27

# Conflicts: # tests/spec/core/highlight.html # worker/respec-worker.js Co-authored-by: marcoscaceres <870154+marcoscaceres@users.noreply.github.com>

Copilot finished work on behalf of marcoscaceres April 18, 2026 00:53

marcoscaceres requested a review from sidvishnoi April 18, 2026 02:02

marcoscaceres requested a review from Copilot April 18, 2026 02:44

Copilot started reviewing on behalf of marcoscaceres April 18, 2026 02:45 View session

Copilot AI reviewed Apr 18, 2026

View reviewed changes

sidvishnoi changed the title ~~fix(worker): remove dead highlight-load-lang code path~~ fix(worker)!: remove dead highlight-load-lang code path Apr 19, 2026

sidvishnoi approved these changes Apr 19, 2026

View reviewed changes

Merge branch 'main' into alert-autofix-24

50d4fcc

marcoscaceres merged commit 58b1303 into main Apr 19, 2026
9 checks passed

marcoscaceres deleted the alert-autofix-24 branch April 19, 2026 12:27

Uh oh!

Uh oh!

Conversation

marcoscaceres commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

marcoscaceres commented Apr 14, 2026

Uh oh!

Copilot AI commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

marcoscaceres commented Apr 14, 2026

Uh oh!

Copilot AI commented Apr 14, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

marcoscaceres commented Apr 17, 2026

Uh oh!

Copilot AI commented Apr 17, 2026

Uh oh!

marcoscaceres commented Apr 18, 2026

Uh oh!

Copilot AI commented Apr 18, 2026

Uh oh!

marcoscaceres commented Apr 18, 2026

Uh oh!

marcoscaceres commented Apr 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

marcoscaceres commented Apr 18, 2026

Uh oh!

sidvishnoi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

marcoscaceres commented Apr 13, 2026 •

edited

Loading

Copilot AI commented Apr 14, 2026 •

edited

Loading