Fix frontend SonarQube findings: SRI, ReDoS, contrast, missing labels - #11
Merged
Conversation
- Add integrity/crossorigin to all cdnjs CodeMirror <link>/<script> tags across sandbox.html, problem.html, and longest-unique-substring.html - Remove duplicate head-loaded codemirror.min.js in longest-unique-substring.html - Fix superlinear regex backtracking in sandbox.js variable-name pattern - Darken run-tests-button colors in problem.css to meet WCAG AA contrast - Add sr-only labels for the code/solution textareas to fix missing associated label accessibility warnings
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Empty
— "heading has no text reachable by a screen reader" (problem.html:50)
False positive. The scanner reads the raw template statically and doesn't evaluate Thymeleaf — th:text injects the real title text into the
at server render time, so the actual HTML sent to the browser always has content. No real
accessibility gap exists. (Could optionally add Thymeleaf's natural-templating fallback text, e.g.
Problem Title
, later — decided not to for now.)xmlns:th="http://www.thymeleaf.org" — "URI is not registered" (8 files: fragments/navbar.html, problems.html, problems-algorithms.html, problems-collections.html, problems-arrays.html, sandbox.html, problem.html,
collections/longest-unique-substring.html)
Not a real defect. This is IntelliJ's own XML-namespace inspection trying to resolve the xmlns value against a schema/DTD. Thymeleaf's namespace URI is just an identifier so th:* attributes are recognized — it isn't a fetchable schema
location, so there's nothing to validate and no functional impact.
"Missed locally stored library for HTTP link" (sandbox.html:22, sandbox.html:74 — CodeMirror show-hint CSS/JS)
IDE convenience suggestion only (offers to cache a local copy for autocomplete). No effect on runtime behavior, security, or code quality.
"Unresolved function or method showHint()" (sandbox.js:234, weak warning)
False positive. showHint() is attached to the CodeMirror editor instance at runtime by the separately-loaded show-hint addon script, so the static analyzer can't resolve it statically — it works correctly in the browser.