From 35bc29916207d726b06c4cdeb6ec4fd69fe1a744 Mon Sep 17 00:00:00 2001 From: ChuckBuilds Date: Thu, 16 Jul 2026 20:07:23 -0400 Subject: [PATCH] fix(web): remove redundant htmx.org substring check flagged by CodeQL CodeQL flags .includes('htmx.org') as "incomplete URL substring sanitization" - a false positive here, since this string is only ever matched against console.error/warn message text to decide whether to suppress a known-harmless HTMX timing-race log line, not used for any URL-trust/redirect decision. The check was also redundant: 'htmx' is already a substring of 'htmx.org', so the plain .includes('htmx') check right next to it already covers every case the removed check did. --- web_interface/static/v3/js/htmx-config.js | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/web_interface/static/v3/js/htmx-config.js b/web_interface/static/v3/js/htmx-config.js index 20761507..3899ce35 100644 --- a/web_interface/static/v3/js/htmx-config.js +++ b/web_interface/static/v3/js/htmx-config.js @@ -69,12 +69,11 @@ errorStr.includes("reading 'insertBefore'")) { // Check if it's from HTMX by looking at stack trace or error string // Also check the call stack if available - const isHtmxError = errorStr.includes('htmx.org') || - errorStr.includes('htmx') || + const isHtmxError = errorStr.includes('htmx') || errorStack.includes('htmx') || args.some(arg => { if (typeof arg === 'string') { - return arg.includes('htmx.org') || arg.includes('htmx'); + return arg.includes('htmx'); } // Check error objects for stack traces if (arg && typeof arg === 'object' && arg.stack) {