Repository navigation
fix(scanner): trim HTML comment bang endings from TODO labels - #3
Conversation
Author model: gpt-6.1-sol (Codex). Independent review pending.
|
Welcome! 👋 Thanks for your first pull request in this repository. A maintainer will review it soon. Please make sure:
Thanks for contributing! |
|
Zweitmodell-Review (Cloud-Bot): Diff gelesen. Die Regex Generated by Claude Code |
|
Independent Cross-Model Review (Gemini 4 Argon High): Verified diff on a577902. Recognizes --!> alongside --> and */ at end of line in core/todo_scanner.py and covers it with test_scan_file_comment_terminators_preserve_task_text. All 18 CI checks green. Approved for merge. |
An HTML TODO ending with --!> retained that closing marker in its displayed task text. Recognize this alternative HTML comment ending alongside --> and the existing C block ending. The regression exercises the real file scanner and preserves unsupported endings, literal markup, mid-text markers, author, line number and original line text.
The new regression fails on the exact main base and all seven scanner/panel tests pass after the two-line production change. Focused Ruff and diff checks pass. Runtime version and dependencies are unchanged. Exact-head CI is required.
This addresses the comment-end pattern reported by CodeQL alert4 in core/todo_scanner.py. That code cleans labels and is not an HTML sanitizer; no exploitable XSS or general HTML-sanitization guarantee is established. The existing alert remains governed by GitHub analysis; it was not dismissed.
Author model: gpt-6.1-sol (Codex). Independent review pending. Draft only; merges disabled. No release or runtime mirror update.