feat: Integration Builder #882
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const value = apiTemplateData[varName] || getSmartDefault(varName); | ||
|
|
||
| // Escape single quotes in the value | ||
| const escapedValue = value.replace(/'/g, "\\'"); |
Check failure
Code scanning / CodeQL
Incomplete string escaping or encoding High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 1 day ago
In general, when constructing a language string literal from arbitrary input, you must escape all characters that have special meaning in that literal context, notably backslashes and the quote character used to delimit the string. Here we are building single-quoted JavaScript string literals, so we should escape backslashes first, then escape single quotes. This ensures that any backslash intended to escape the following character in the literal is itself made literal, and our single-quote escaping remains effective.
The best minimal fix is to change the computation of escapedValue in generateTemplateDataCode to first replace backslashes (\) with double backslashes (\\), and then replace single quotes (') with escaped single quotes (\'). This keeps all existing behavior but correctly handles backslashes. Concretely, in apps/learn-card-app/src/pages/appStoreDeveloper/partner-onboarding/steps/DataMappingStep.tsx, around line 663–666, replace the current escapedValue line with two chained replace calls in the proper order:
const escapedValue = value
.replace(/\\/g, '\\\\')
.replace(/'/g, "\\'");No new imports or helper functions are required; we only adjust the escaping logic inside the existing function.
| @@ -660,8 +660,10 @@ | ||
| // Use the user-entered value or smart default | ||
| const value = apiTemplateData[varName] || getSmartDefault(varName); | ||
|
|
||
| // Escape single quotes in the value | ||
| const escapedValue = value.replace(/'/g, "\\'"); | ||
| // Escape backslashes and single quotes in the value for use in a single-quoted JS string literal | ||
| const escapedValue = value | ||
| .replace(/\\/g, '\\\\') | ||
| .replace(/'/g, "\\'"); | ||
|
|
||
| return `${indent}${varName}: '${escapedValue}',`; | ||
| }); |
|
🥷 Code experts: TaylorBeeston Custard7, TaylorBeeston have most 👩💻 activity in the files. See details
Activity based on git-commit:
Knowledge based on git-blame:
Activity based on git-commit:
Knowledge based on git-blame:
Activity based on git-commit:
Knowledge based on git-blame:
Activity based on git-commit:
Knowledge based on git-blame:
Activity based on git-commit:
Knowledge based on git-blame:
Activity based on git-commit:
Knowledge based on git-blame:
Activity based on git-commit:
Knowledge based on git-blame:
Activity based on git-commit:
Knowledge based on git-blame:
Activity based on git-commit:
Knowledge based on git-blame:
Activity based on git-commit:
Knowledge based on git-blame:
Activity based on git-commit:
Knowledge based on git-blame: ✨ Comment |
Overview
🎟 Relevant Jira Issues
📚 What is the context and goal of this PR?
🥴 TL; RL:
💡 Feature Breakdown (screenshots & videos encouraged!)
🛠 Important tradeoffs made:
🔍 Types of Changes
💳 Does This Create Any New Technical Debt? ( If yes, please describe and add JIRA TODOs )
Testing
🔬 How Can Someone QA This?
📱 🖥 Which devices would you like help testing on?
🧪 Code Coverage
Documentation
📜 Gitbook
📊 Storybook
✅ PR Checklist
🚀 Ready to squash-and-merge?: