wip

Author: sebastienfontaine

.github/workflows/ci.yml

@@ -75,13 +75,23 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Run Gitleaks
-        uses: gitleaks/gitleaks-action@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+      - name: Run Gitleaks (fail on leaks)
+        uses: docker://gitleaks/gitleaks:latest
         with:
-          args: detect --no-git -v --redact --exit-code 1
+          args: detect --source . --no-git --redact --report-format sarif --report-path gitleaks.sarif --exit-code 1
+
+      - name: Upload Gitleaks SARIF as artifact
+        if: always() && hashFiles('gitleaks.sarif') != ''
+        uses: actions/upload-artifact@v4
+        with:
+          name: gitleaks-scan-results
+          path: gitleaks.sarif
+
+      - name: Upload Gitleaks SARIF to Code Scanning
+        if: always() && hashFiles('gitleaks.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: gitleaks.sarif
 
   dependency_audit:
     name: Dependency Vulnerability Audit

src/content.js

@@ -58,15 +58,19 @@ export function getTextBySelector(selector) {
 	if (selector.includes('*')) {
 		const parts = selector.split(' ');
 
+		const toSafe = (s) =>
+			typeof CSS !== 'undefined' && CSS.escape
+				? CSS.escape(s)
+				: s.replace(/[\"]/g, '$&').replace(/]/g, ']');
+
 		const modifiedParts = parts.map((part) => {
-			if (part.includes('*')) {
-				if (part.startsWith('.')) {
-					return `[class*="${part.replace('.', '').replace('*', '')}"]`;
-				} else {
-					return `[${part.replace('*', '')}]`;
-				}
+			if (!part.includes('*')) return part;
+			if (part.startsWith('.')) {
+				const raw = part.replace(/\./g, '').replace(/\*/g, '');
+				return `[class*="${toSafe(raw)}"]`;
 			}
-			return part;
+			const rawAttr = part.replace(/\*/g, '');
+			return `[${toSafe(rawAttr)}]`;
 		});
 
 		const modifiedSelector = modifiedParts.join(' ');

src/content.test.js

@@ -158,8 +158,8 @@ describe('Content', () => {
 			const rule = {
 				tab: {
 					title: '@0 | $0',
-					title_matcher: '[a-z]*@gmail.com',
-					url_matcher: '[a-z]*.google.com',
+					title_matcher: '^[a-z]*@gmail\\.com$',
+					url_matcher: '^[a-z]+\\.google\\.com$',
 				},
 			};