mirror of
https://github.com/Donkie/Spoolman.git
synced 2026-10-23 02:22:20 -05:00
Donkie
24e6f7fd34
CodeQL flagged esc() in the Playwright global teardown: it replaced the markdown cell separator with an escaped one but left backslashes alone, so an input ending in a backslash produced a doubled backslash followed by a bare pipe -- the backslash escaped itself and the pipe went on to split the row. axe help strings and CSS selectors are arbitrary page content, so that is reachable, if only ever in a local audit report. Escaping both metacharacters in a single pass fixes it: nothing the replacer emits is re-examined, so an escape can't be consumed by the character before it. Newlines get flattened at the same time, since a newline ends a table row just as effectively as a stray pipe did. Claude-Session: https://claude.ai/code/session_01UB5KocsTBm9GL5x3Uuup5F