From cceb041cf1ea051b7e60df2744587a0e07de3f6c Mon Sep 17 00:00:00 2001
From: Anton Arnaudov <anton.arnaudov.me@gmail.com>
Date: Wed, 30 Sep 2026 18:36:54 +0300
Subject: [PATCH] test: close CodeQL's three findings in the webview-ui test
 helpers

The fake DOM strips tags until nothing changes, so a nested '<<b>b>'
cannot leave a tag behind; the escaping tests check for raw markup with
includes() instead of a regex CodeQL reads as an HTML filter.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 packages/webview-ui/test/avatar.cov.test.ts |  2 +-
 packages/webview-ui/test/fakeDom.cov.ts     | 10 +++++++++-
 packages/webview-ui/test/refTip.cov.test.ts |  2 +-
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/packages/webview-ui/test/avatar.cov.test.ts b/packages/webview-ui/test/avatar.cov.test.ts
index 8d425498..a28966ae 100644
--- a/packages/webview-ui/test/avatar.cov.test.ts
+++ b/packages/webview-ui/test/avatar.cov.test.ts
@@ -93,7 +93,7 @@ test("a photo that already loaded once renders visible straight away", () => {
 
 test("the avatar markup escapes the name, the ring and the URL", () => {
   const html = avatarHtml("<b", "x@y", 0, 'red" onmouseover="x', 'https://e/"><script>', false);
-  assert.doesNotMatch(html, /<script>|<b|onmouseover="x/);
+  for (const raw of ["<script>", "<b", 'onmouseover="x']) assert.ok(!html.includes(raw), raw);
   assert.match(html, /<span class="fallback">&lt;B<\/span>/);
   assert.match(html, /--gs-av-ring:red&quot; onmouseover=&quot;x"/);
   assert.match(html, /src="https:\/\/e\/&quot;&gt;&lt;script&gt;"/);
diff --git a/packages/webview-ui/test/fakeDom.cov.ts b/packages/webview-ui/test/fakeDom.cov.ts
index 3abe770e..ffdcc2fd 100644
--- a/packages/webview-ui/test/fakeDom.cov.ts
+++ b/packages/webview-ui/test/fakeDom.cov.ts
@@ -69,7 +69,15 @@ export class FakeElement {
   }
 
   get textContent(): string {
-    if (this.rawHtml) return this.rawHtml.replace(/<[^>]*>/g, "");
+    if (this.rawHtml) {
+      // Until nothing changes: one pass over "<<b>b>" leaves a "<b>" behind.
+      let text = this.rawHtml;
+      for (let prev = ""; prev !== text; ) {
+        prev = text;
+        text = text.replace(/<[^>]*>/g, "");
+      }
+      return text;
+    }
     return this.childNodes.map((n) => n.textContent).join("");
   }
   set textContent(v: string) {
diff --git a/packages/webview-ui/test/refTip.cov.test.ts b/packages/webview-ui/test/refTip.cov.test.ts
index 08c9bda3..ccdce238 100644
--- a/packages/webview-ui/test/refTip.cov.test.ts
+++ b/packages/webview-ui/test/refTip.cov.test.ts
@@ -112,7 +112,7 @@ test("a hostile ref name reaches the card as text, in the row and in its attribu
   ]);
   tip.handleOver(over(pill));
   tick(90);
-  assert.doesNotMatch(card.innerHTML, /<img|<script>|data-full="refs\/tags\/"x"/);
+  for (const raw of ["<img", "<script>", 'data-full="refs/tags/"x"']) assert.ok(!card.innerHTML.includes(raw), raw);
   assert.match(card.innerHTML, /data-ref="&quot;&gt;&lt;img src=x onerror=alert\(1\)&gt;"/);
   assert.match(card.innerHTML, /also on &lt;script&gt;/);
 });