[AGX-5628] Facilitating the indexing and searching of dev docs - #331
[AGX-5628] Facilitating the indexing and searching of dev docs#331jl4ever wants to merge 3 commits into
Conversation
Sorry, something went wrong.
This will process the content_catalog.json and parses through the file specific md files and compile it into a raw content json file for data indexing
(cherry picked from commit f0e5fab) Add in the ability to dynamically tune the host pointer for dev-portal
| if (window.location.hostname === "localhost" || window.location.hostname === "127.0.0.1") { | ||
| return "http://localhost:3001"; | ||
| } | ||
| if (window.location.hostname.indexOf("github.io") !== -1) { |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Copilot Autofix
AI 6 months ago
In general, this type of problem is fixed by avoiding substring checks on hostnames and instead validating the host using proper parsing and strict matching (for example, exact hostname equality or checking that it ends with a specific suffix preceded by a dot). Here, window.location.hostname is already the parsed hostname, so we only need to replace the substring check with a safer suffix check.
The best minimal fix without changing functionality is to replace:
if (window.location.hostname.indexOf("github.io") !== -1) {
return "https://developers.procore.com";
}with a check that only matches GitHub Pages hostnames, i.e., hostnames that either equal github.io or end with .github.io. We can do this using String.prototype.endsWith, which is widely supported in modern browsers, and a direct equality check. No new imports or dependencies are required, and all other behavior of searchApiBase() remains unchanged.
Concretely, in assets/js/nav.js around line 83–88, change the indexOf("github.io") !== -1 condition to:
var host = window.location.hostname;
if (host === "github.io" || host.endsWith(".github.io")) {
return "https://developers.procore.com";
}This ensures that only legitimate GitHub Pages hostnames like org.github.io or user.github.io trigger the GitHub-specific base URL, avoiding the incomplete substring sanitization issue.
Autofix patch
cat << 'EOF' | git apply
diff --git a/assets/js/nav.js b/assets/js/nav.js
--- a/assets/js/nav.js
+++ b/assets/js/nav.js
@@ -83,7 +83,8 @@
if (window.location.hostname === "localhost" || window.location.hostname === "127.0.0.1") {
return "http://localhost:3001";
}
- if (window.location.hostname.indexOf("github.io") !== -1) {
+ var host = window.location.hostname;
+ if (host === "github.io" || host.endsWith(".github.io")) {
return "https://developers.procore.com";
}
return window.location.origin;
EOF
| @@ -83,7 +83,8 @@ | ||
| if (window.location.hostname === "localhost" || window.location.hostname === "127.0.0.1") { | ||
| return "http://localhost:3001"; | ||
| } | ||
| if (window.location.hostname.indexOf("github.io") !== -1) { | ||
| var host = window.location.hostname; | ||
| if (host === "github.io" || host.endsWith(".github.io")) { | ||
| return "https://developers.procore.com"; | ||
| } | ||
| return window.location.origin; |
Summary of changes
Adding a new github workflow which will process the content_catalog.json (hardcoded) and parses through the file specific md files and compile it into a raw content json file for data indexing