Issue Queue Pool#35
Merged
sachin-panayil merged 1 commit intomainfrom Jun 25, 2025
Merged
Conversation
Signed-off-by: Sachin Panayil <sachinpanayil01@gmail.com>
sachin-panayil
requested review from
DinneK,
IsaacMilarky,
decause-gov and
natalialuzuriaga
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| return; | ||
| } | ||
|
|
||
| issuesGrid.innerHTML = filteredIssues.map(createIssueCard).join(''); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To fix the issue, all dynamic data used in createIssueCard must be sanitized using the escapeHtml function or equivalent contextual escaping. Specifically:
- Ensure that
typeTagselements are sanitized before being concatenated and injected into the DOM. - Sanitize
issue.urlbefore using it in the<a>tag'shrefattribute. - Replace
issuesGrid.innerHTMLwith safer methods liketextContentorappendChildwhere possible, or ensure all data is sanitized before usinginnerHTML.
Suggested changeset
1
assets/_common/js/issue-filters.js
| @@ -170,11 +170,11 @@ | ||
| if (issue.isOpen) { | ||
| typeTags.push('<span class="usa-tag usa-tag--success">Open</span>'); | ||
| typeTags.push(escapeHtml('<span class="usa-tag usa-tag--success">Open</span>')); | ||
| } else { | ||
| typeTags.push('<span class="usa-tag">Closed</span>'); | ||
| typeTags.push(escapeHtml('<span class="usa-tag">Closed</span>')); | ||
| } | ||
|
|
||
| if (issue.isBug) typeTags.push('<span class="usa-tag usa-tag--error">Bug</span>'); | ||
| if (issue.isFeature) typeTags.push('<span class="usa-tag usa-tag--info">Feature</span>'); | ||
| if (issue.needsHelp) typeTags.push('<span class="usa-tag usa-tag--accent-warm">Help Wanted</span>'); | ||
| if (issue.isBeginner) typeTags.push('<span class="usa-tag usa-tag--accent-cool">Good First Issue</span>'); | ||
| if (issue.isBug) typeTags.push(escapeHtml('<span class="usa-tag usa-tag--error">Bug</span>')); | ||
| if (issue.isFeature) typeTags.push(escapeHtml('<span class="usa-tag usa-tag--info">Feature</span>')); | ||
| if (issue.needsHelp) typeTags.push(escapeHtml('<span class="usa-tag usa-tag--accent-warm">Help Wanted</span>')); | ||
| if (issue.isBeginner) typeTags.push(escapeHtml('<span class="usa-tag usa-tag--accent-cool">Good First Issue</span>')); | ||
|
|
||
| @@ -184,3 +184,3 @@ | ||
| <h3 class="margin-top-0 margin-bottom-1"> | ||
| <a href="${issue.url}" target="_blank" rel="noopener noreferrer" class="usa-link"> | ||
| <a href="${escapeHtml(issue.url)}" target="_blank" rel="noopener noreferrer" class="usa-link"> | ||
| ${escapeHtml(issue.title || 'Untitled Issue')} | ||
| @@ -198,3 +198,3 @@ | ||
| <div class="font-body-xs text-base-dark"> | ||
| ${issue.commentCount || 0} comments • | ||
| ${escapeHtml(issue.commentCount || 0)} comments • | ||
| Created ${formatDate(issue.createdDate)} • |
Copilot is powered by AI and may make mistakes. Always verify output.
decause-gov
approved these changes
Jun 24, 2025
decause-gov
left a comment
decause-gov
left a comment
There was a problem hiding this comment.
LGTM +1 🚢
Let's see how it looks!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue Queue Pool
Problem
code.gov originally had an issue pool tracker where users can track issues from federal repos that opt in via a specific set of labels.
Solution
This branch tracks the recreation of that tool.
Result
Issue Queue Pool will be back up and running. Below will be a checklist of things that need to be accomplished regarding this task.
Checklist
code-govlabelsNotes
Test Plan
Test this locally via web browser and by running scripts using
nodeor GH Actions