Md editor integration tests

[abose]

No description provided.

In general, instead of checking for a URL by substring on a large blob of text, either (a) parse and check the URL structurally (e.g., via a URL parser and host/path equality checks) or (b) in the context of a test, assert that the exact expected snippet (e.g., the full markdown link or exact attribute value) appears and the old snippet does not. This avoids passing when the substring appears in an unintended position.

For this specific test, we should avoid cmVal.includes("https://edited-popover.example.com") and instead check for the exact expected markdown link that the editor should have written when the popover changed the link. Earlier in the test we know there is an anchor with href='https://edited-popover.example.com' in the rendered HTML. In Markdown, that link will be represented as [link‑label](https://edited-popover.example.com) (the exact label comes from doc2.md, but the test already assumes a URL ending in test-link-doc2, so we can similarly assume a stable exact markdown substring for the new URL). To keep changes minimal and avoid relying on unknown label text, a robust compromise is to (1) assert that the old URL string is absent, and (2) assert that the exact expected URL string occurs only as part of a proper markdown link (i.e. immediately after an opening parenthesis). That can be done with a simple indexOf("](" + newUrl + ")") check or a small regex. Since this is a test file and we must not add heavy dependencies or change imports, using native JS (e.g., RegExp and test) is appropriate.

Concretely, in test/spec/md-editor-integ-test.js at lines 1663–1667, replace:

• The check cmVal.includes("https://edited-popover.example.com") with a check that looks for "(" + "https://edited-popover.example.com" + ")" preceded by ], or use a regex like /\]\(https:\/\/edited-popover\.example\.com\)/.test(cmVal).
• Keep the negative check for "test-link-doc2.example.com" but possibly tighten it to the specific old URL form if known; at minimum, keep the existing negated includes.

This keeps functionality (the test still waits for the document to reflect the edited URL and not the old one) while removing the incomplete substring sanitization pattern flagged by CodeQL.

In general, to fix incomplete URL substring sanitization you should parse the URL(s) and compare their host components against an explicit whitelist or against exact expected hostnames, instead of using substring checks on the whole URL string. When checking that an “old URL” is gone and a “new URL” is present, this means extracting URLs from the text and validating their hosts, or at minimum ensuring that any hostname comparison is done on parsed hosts, not arbitrary substrings.

In this specific test, we want to keep the current functionality: confirm that the edited URL https://edited-popover.example.com is present in the editor contents and that no link remains that points to test-link-doc2.example.com. We can make this explicit and URL-aware by: (1) extracting all HTTP(S) URLs from the editor text via a simple regex, (2) parsing each with the built-in URL class, and (3) checking that one of them has href === "https://edited-popover.example.com" and that none of them have host === "test-link-doc2.example.com". This avoids substring checks on the entire document string and aligns with CodeQL’s recommendation. Concretely, we only need to adjust the awaitsFor predicate in lines 1663–1667 to operate on parsed URLs extracted from the document text. No new external dependencies are needed; the standard URL class is available in the browser-like test environment.

General fix: Ensure that the value taken from the DOM (urlInput.value) is validated and restricted before being written back to the DOM in a way that might later be reinterpreted as HTML. For a URL going into an img element’s src, a robust mitigation is to only accept URLs with safe schemes (e.g., http, https, possibly data:image/...) and reject or ignore anything else.

Best way for this snippet: Introduce a small URL-validation helper in image-popover.js that checks the scheme of the user-provided URL. When the user clicks “save”, we compute url, pass it through this validator, and only call imgEl.setAttribute("src", url) if it passes. If it fails, we can simply return without applying the change (or in a fuller UX, show an error—but we will not change functionality beyond minimal safety). This leaves normal usage (pasting or typing typical image URLs) working as before, while blocking clearly unsafe or malformed input that could contribute to a DOM-text-reinterpreted-as-HTML chain elsewhere in the app.

Concretely:

• In src-mdviewer/src/components/image-popover.js, above showEditDialog, add a helper isSafeImageUrl(url) that:
  • Tries to construct a new URL(url, window.location.href) so that relative URLs still work.
  • Checks that parsed.protocol is http: or https:, or that the original string matches a whitelisted data:image/ form if you want to allow inline images.
• In the #img-edit-save click handler, after computing url, call isSafeImageUrl(url) and only set src if it returns true. If not, just close() without updating src (minimal behavioral change).
• No external dependencies are needed; this can be done with built-in URL.

[sonarqubecloud]

Quality Gate failed

Failed conditions
D Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE