From 49a99c1c75ee2e58ea4242aec64ddabca8dee129 Mon Sep 17 00:00:00 2001 From: ChuckBuilds Date: Thu, 16 Jul 2026 11:26:22 -0400 Subject: [PATCH] =?UTF-8?q?chore(web):=20CI=20cleanup=20=E2=80=94=20declar?= =?UTF-8?q?e=20debugLog=20global,=20fix=20entity-unescape=20order,=20drop?= =?UTF-8?q?=20v3=20from=20UI=20branding?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add debugLog to the /* global */ headers of the six JS files that call it (defined in base.html's first inline script) — resolves the wall of "'debugLog' is not defined" ESLint errors failing the Codacy check. - Fix the two js/double-escaping CodeQL alerts in app-shell.js: the entity-unescape chains decoded & before </>, so a value containing a pre-escaped "&lt;" wrongly double-decoded to "<". & now decodes last (standard order). Pre-existing bug, made visible when the inline scripts moved into scannable .js files. - Page title / header drop the "- v3" suffix, matching the de-versioned user-facing URL. The remaining 7 CodeQL alerts are pre-existing patterns newly visible to scanning (CodeQL doesn't see inline template JS): 4 github.com/htmx.org URL-substring checks (the htmx ones match error-message text, not URLs — false positives in context) and 1 innerHTML XSS-through-DOM in the GitHub install flow. Triage/fix deferred to a focused follow-up rather than expanding this PR. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01KEZK1P1Q1fu5pcuVrkrCFZ --- web_interface/static/v3/app.js | 2 +- web_interface/static/v3/js/app-early.js | 1 + web_interface/static/v3/js/app-shell.js | 9 +++++---- web_interface/static/v3/js/custom-feeds-helpers.js | 1 + web_interface/static/v3/js/htmx-config.js | 1 + web_interface/static/v3/plugins_manager.js | 1 + web_interface/templates/v3/base.html | 4 ++-- 7 files changed, 12 insertions(+), 7 deletions(-) diff --git a/web_interface/static/v3/app.js b/web_interface/static/v3/app.js index e5f0d36a..dd17fc7d 100644 --- a/web_interface/static/v3/app.js +++ b/web_interface/static/v3/app.js @@ -1,4 +1,4 @@ -/* global showNotification, updateSystemStats, updateDisplayPreview, htmx */ +/* global showNotification, updateSystemStats, updateDisplayPreview, htmx, debugLog */ // LED Matrix v3 JavaScript // Additional helpers for HTMX and Alpine.js integration diff --git a/web_interface/static/v3/js/app-early.js b/web_interface/static/v3/js/app-early.js index 91ded445..0da92f21 100644 --- a/web_interface/static/v3/js/app-early.js +++ b/web_interface/static/v3/js/app-early.js @@ -1,3 +1,4 @@ +/* global debugLog */ // Early helpers and the app() stub (must run before Alpine init) // Extracted from templates/v3/base.html so browsers cache it as a static asset. // Helper function to get installed plugins with fallback diff --git a/web_interface/static/v3/js/app-shell.js b/web_interface/static/v3/js/app-shell.js index c366b16b..6c18b888 100644 --- a/web_interface/static/v3/js/app-shell.js +++ b/web_interface/static/v3/js/app-shell.js @@ -1,3 +1,4 @@ +/* global debugLog */ // SSE wiring + full Alpine app() implementation and tab logic // Extracted from templates/v3/base.html so browsers cache it as a static asset. // Assign to window so reconnectSSE() in app.js can reach them. @@ -1480,9 +1481,9 @@ unescapedValue = value .replace(/"/g, '"') .replace(/'/g, "'") - .replace(/&/g, '&') .replace(/</g, '<') - .replace(/>/g, '>'); + .replace(/>/g, '>') + .replace(/&/g, '&'); } // Try to parse as JSON @@ -2253,9 +2254,9 @@ unescapedValue = value .replace(/"/g, '"') .replace(/'/g, "'") - .replace(/&/g, '&') .replace(/</g, '<') - .replace(/>/g, '>'); + .replace(/>/g, '>') + .replace(/&/g, '&'); } try { diff --git a/web_interface/static/v3/js/custom-feeds-helpers.js b/web_interface/static/v3/js/custom-feeds-helpers.js index 0ce98f15..36cced87 100644 --- a/web_interface/static/v3/js/custom-feeds-helpers.js +++ b/web_interface/static/v3/js/custom-feeds-helpers.js @@ -1,3 +1,4 @@ +/* global debugLog */ // Custom feeds table helper functions // Extracted from templates/v3/base.html so browsers cache it as a static asset. function addCustomFeedRow(fieldId, fullKey, maxItems, pluginId) { diff --git a/web_interface/static/v3/js/htmx-config.js b/web_interface/static/v3/js/htmx-config.js index 9c38eda4..2de0f79d 100644 --- a/web_interface/static/v3/js/htmx-config.js +++ b/web_interface/static/v3/js/htmx-config.js @@ -1,3 +1,4 @@ +/* global debugLog */ // HTMX swap/script-execution configuration and section toggle helpers // Extracted from templates/v3/base.html so browsers cache it as a static asset. // Configure HTMX to evaluate scripts in swapped content and fix insertBefore errors diff --git a/web_interface/static/v3/plugins_manager.js b/web_interface/static/v3/plugins_manager.js index b8d3a24a..9b740c81 100644 --- a/web_interface/static/v3/plugins_manager.js +++ b/web_interface/static/v3/plugins_manager.js @@ -1,3 +1,4 @@ +/* global debugLog */ // ─── LocalStorage Safety Wrappers ──────────────────────────────────────────── // Handles environments where localStorage is unavailable or restricted (private browsing, etc.) const safeLocalStorage = { diff --git a/web_interface/templates/v3/base.html b/web_interface/templates/v3/base.html index 72c23d55..27c4577e 100644 --- a/web_interface/templates/v3/base.html +++ b/web_interface/templates/v3/base.html @@ -3,7 +3,7 @@ - LED Matrix Control Panel - v3 + LED Matrix Control Panel