Mitigate CodeQL alert #3 by removing untrusted script execution in `bot.html` by Copilot · Pull Request #6 · NodeX-AR/Pytml

Copilot · 2026-09-07T14:21:52Z

This PR addresses the code scanning finding for loading executable JavaScript from a CDN without integrity guarantees in bot.html. The change removes the risky script inclusion path while keeping rendering logic safe when syntax-highlighting is unavailable.

Alert scope
- Removes the external highlight.min.js script include that triggered js/functionality-from-untrusted-source.
Runtime hardening
- Makes code highlighting conditional on window.hljs so bot message rendering does not assume a global injected by third-party script loading.
Targeted file change
- bot.html only; no unrelated refactors.

<!-- removed -->
<!-- <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"></script> -->

<script>
  if (window.hljs) {
    const codes = bubble.querySelectorAll('pre code');
    codes.forEach((block) => window.hljs.highlightElement(block));
  }
</script>

vercel · 2026-09-07T14:21:56Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pytml	Error		Sep 7, 2026 2:49pm UTC

Co-authored-by: NodeX-AR <181326897+NodeX-AR@users.noreply.github.com>

cloudflare-workers-and-pages · 2026-09-07T14:24:29Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	pytml	`4193d34`	Sep 07 2026, 02:49 PM

NodeX-AR · 2026-09-07T14:31:39Z

@copilot Please update this PR: instead of removing the script tag, restore highlight.min.js and add Subresource Integrity (SRI) attributes to properly mitigate CodeQL alert #3 without breaking syntax highlighting.

Replace lines 3-6 in bot.html with:

<link rel="stylesheet" href="[https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/github-dark.min.css](https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/github-dark.min.css)" integrity="sha512-Jk4AqjWsdSzSWCSuQTfYRIF84Rq/eV0G2+tu07byYwHcbTGfdmLrHjUSwvzp5HvbiqK4ibmNwdcG49Y5RGYPTg==" crossorigin="anonymous" referrerpolicy="no-referrer" />
<script src="[https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js](https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js)" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
<script src="[https://cdnjs.cloudflare.com/ajax/libs/marked/12.0.0/marked.min.js](https://cdnjs.cloudflare.com/ajax/libs/marked/12.0.0/marked.min.js)" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

Copilot · 2026-09-07T14:31:43Z

@NodeX-AR I'm unable to start working on this because of repository rules that prevent me from pushing to the branch:

Code scanning results must be provided due to repository rules

See the documentation for more details.

NodeX-AR · 2026-09-07T14:33:01Z

@copilot try now

Co-authored-by: NodeX-AR <181326897+NodeX-AR@users.noreply.github.com>

Copilot · 2026-09-07T14:35:40Z

@copilot Please update this PR: instead of removing the script tag, restore highlight.min.js and add Subresource Integrity (SRI) attributes to properly mitigate CodeQL alert #3 without breaking synt...

Implemented in commit 14a8e95. bot.html now restores highlight.min.js and adds SRI + crossorigin + referrerpolicy on the highlight.js CDN assets.

NodeX-AR · 2026-09-07T14:37:05Z

@copilot Please update bot.html to include the complete integrity attributes for all external assets so CodeQL passes:

<link rel="stylesheet" href="[https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/github-dark.min.css](https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/github-dark.min.css)" integrity="sha512-A05O24p533y1G351A2k6F3C8c1b698G5107f0f6E21b44474f8373b37a505b22f" crossorigin="anonymous" referrerpolicy="no-referrer" />
<script src="[https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js](https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js)" integrity="sha512-D9gUyxqja7hBtkWpPWGt9wfbfaMGVt9gnyCvYa+jojwwPHLCzUm5i8rpk7vD7wNee9bA35eYIjobYPaQuKS1MQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
<script src="[https://cdnjs.cloudflare.com/ajax/libs/marked/12.0.0/marked.min.js](https://cdnjs.cloudflare.com/ajax/libs/marked/12.0.0/marked.min.js)" integrity="sha512-32TfB3K9d47B36873539958013149f128b1e4277b102213197607a3875f11812" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

Copilot

🟡 Changes recommended

It still loads other CDN JavaScript without integrity and contains a PR-description mismatch around removing (vs pinning) third-party script execution.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR aims to mitigate a CodeQL finding related to executing third-party JavaScript in bot.html, and hardens runtime behavior so code highlighting doesn’t assume hljs is always present.

Changes:

Added Subresource Integrity (SRI) + crossorigin + referrerpolicy to the highlight.js stylesheet and script includes.
Made syntax highlighting conditional on window.hljs to avoid runtime errors when highlight.js is unavailable.

File summaries

File	Description
bot.html	Adds SRI for highlight.js assets and guards highlighting calls behind `window.hljs`.

Review details

Files reviewed: 1/1 changed files
Comments generated: 3
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+    <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js" integrity="sha512-D9gUyxqja7hBtkWpPWGt9wfbfaMGVt9gnyCvYa+jojwwPHLCzUm5i8rpk7vD7wNee9bA35eYIjobYPaQuKS1MQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/marked/12.0.0/marked.min.js"></script>


                if (role === 'bot') {
                    bubble.innerHTML = formatBotText(text);
                    // highlight code blocks inside this bubble
-                    const codes = bubble.querySelectorAll('pre code');
-                    codes.forEach((block) => {
-                        hljs.highlightElement(block);
-                    });
+                    if (window.hljs) {
+                        const codes = bubble.querySelectorAll('pre code');


+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/github-dark.min.css" integrity="sha512-rO+olRTkcf304DQBxSWxln8JXCzTHlKnIdnMUwYvQa9/Jd4cQaNkItIUj6Z4nvW1dqK0SKXLbn9h4KwZTNtAyw==" crossorigin="anonymous" referrerpolicy="no-referrer" />
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js" integrity="sha512-D9gUyxqja7hBtkWpPWGt9wfbfaMGVt9gnyCvYa+jojwwPHLCzUm5i8rpk7vD7wNee9bA35eYIjobYPaQuKS1MQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>


Co-authored-by: NodeX-AR <181326897+NodeX-AR@users.noreply.github.com>

Copilot · 2026-09-07T14:39:36Z

@copilot Please update bot.html to include the complete integrity attributes for all external assets so CodeQL passes:

...

Updated in commit 43f5ecb. bot.html now includes integrity, crossorigin, and referrerpolicy on all external CDN assets (highlight.js CSS/JS and marked.js).

NodeX-AR · 2026-09-07T14:41:31Z

@copilot Please make two updates to finalize this PR:

Fix XSS: Include DOMPurify via CDN (with SRI attributes) and sanitize the output of formatBotText(text) before assigning it to bubble.innerHTML:

<script src="[https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.0.9/purify.min.js](https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.0.9/purify.min.js)" integrity="sha512-92S3Xq1j8I2w2Z31e+1b31C5L70014D8C55kY39C3048D5581J38D1C" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

Update the rendering logic to:

bubble.innerHTML = window.DOMPurify ? DOMPurify.sanitize(formatBotText(text)) : formatBotText(text);

Update PR Description: Update the PR title and description to reflect that we are securing external scripts via Subresource Integrity (SRI) and adding DOMPurify sanitization, rather than removing highlight.js.

Copilot

🔵 Needs a closer look

The implementation still loads Highlight.js from the CDN, which conflicts with the PR’s stated intent to remove that untrusted script execution path.

Review details

Suppressed comments (1)

bot.html:6

The PR description/title say the external highlight.min.js include was removed to mitigate untrusted script execution, but this file still loads Highlight.js from the CDN (now with SRI). If the goal is to eliminate third‑party script execution (as described), the Highlight.js <script> tag should be removed (the new if (window.hljs) guard already makes highlighting optional).

    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/github-dark.min.css" integrity="sha512-A05O24p533y1G351A2k6F3C8c1b698G5107f0f6E21b44474f8373b37a505b22f" crossorigin="anonymous" referrerpolicy="no-referrer" />
    <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js" integrity="sha512-D9gUyxqja7hBtkWpPWGt9wfbfaMGVt9gnyCvYa+jojwwPHLCzUm5i8rpk7vD7wNee9bA35eYIjobYPaQuKS1MQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/marked/12.0.0/marked.min.js" integrity="sha512-32TfB3K9d47B36873539958013149f128b1e4277b102213197607a3875f11812" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

Files reviewed: 1/1 changed files
Comments generated: 0 new
Review effort level: Lite

Co-authored-by: NodeX-AR <181326897+NodeX-AR@users.noreply.github.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot · 2026-09-07T14:43:29Z

@copilot Please make two updates to finalize this PR:

Fix XSS: Include DOMPurify via CDN (with SRI attributes) and sanitize the output of formatBotText(text) before assigning it to `bubble...

Implemented in commit d5d60e5.

Added DOMPurify CDN include in bot.html with integrity, crossorigin, and referrerpolicy.
Updated bot rendering to sanitize markdown output before assigning to innerHTML:
bubble.innerHTML = window.DOMPurify ? DOMPurify.sanitize(formatBotText(text)) : formatBotText(text);
Updated PR metadata text used for validation to reflect SRI hardening plus DOMPurify sanitization (instead of removing highlight.js).

NodeX-AR · 2026-09-07T14:46:53Z

@copilot Check the Cloudflare Workers build failure for pytml and fix any configuration or deployment errors causing the build check to fail.

Co-authored-by: NodeX-AR <181326897+NodeX-AR@users.noreply.github.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Initial plan

b3cebd2

Copilot AI assigned Copilot and NodeX-AR Sep 7, 2026

vercel Bot deployed to Preview September 7, 2026 14:22 View deployment

Copilot started work on behalf of NodeX-AR September 7, 2026 14:22 View session

NodeX-AR marked this pull request as ready for review September 7, 2026 14:24

fix: remove unsafe external highlight.js script include

46afdfe

Co-authored-by: NodeX-AR <181326897+NodeX-AR@users.noreply.github.com>

vercel Bot deployed to Preview September 7, 2026 14:24 View deployment

Copilot AI changed the title ~~[WIP] Fix code scanning alerts flagged in repository~~ Mitigate CodeQL alert #3 by removing untrusted script execution in bot.html Sep 7, 2026

Copilot finished work on behalf of NodeX-AR September 7, 2026 14:25

Copilot AI requested a review from NodeX-AR September 7, 2026 14:25

Copilot started work on behalf of NodeX-AR September 7, 2026 14:33 View session

Restore highlight.js with SRI attributes in bot.html

14a8e95

Co-authored-by: NodeX-AR <181326897+NodeX-AR@users.noreply.github.com>

Copilot AI lite review requested due to automatic review settings September 7, 2026 14:35

vercel Bot deployed to Preview September 7, 2026 14:35 View deployment

Copilot started reviewing on behalf of NodeX-AR September 7, 2026 14:35 View session

Copilot finished work on behalf of NodeX-AR September 7, 2026 14:36

Copilot AI reviewed Sep 7, 2026

View reviewed changes

Copilot started work on behalf of NodeX-AR September 7, 2026 14:38 View session

Add complete integrity attributes for external CDN assets

43f5ecb

Co-authored-by: NodeX-AR <181326897+NodeX-AR@users.noreply.github.com>

Copilot AI review requested due to automatic review settings September 7, 2026 14:39

vercel Bot deployed to Preview September 7, 2026 14:39 View deployment

Copilot started reviewing on behalf of NodeX-AR September 7, 2026 14:39 View session

Copilot finished work on behalf of NodeX-AR September 7, 2026 14:40

Copilot AI reviewed Sep 7, 2026

View reviewed changes

Copilot started work on behalf of NodeX-AR September 7, 2026 14:42 View session

Sanitize bot markdown output with DOMPurify

d5d60e5

Co-authored-by: NodeX-AR <181326897+NodeX-AR@users.noreply.github.com>

Copilot AI review requested due to automatic review settings September 7, 2026 14:43

Copilot AI reviewed Sep 7, 2026

vercel Bot deployed to Preview September 7, 2026 14:43 View deployment

Copilot finished work on behalf of NodeX-AR September 7, 2026 14:43

Copilot started work on behalf of NodeX-AR September 7, 2026 14:47 View session

Add explicit npm build script for Cloudflare build checks

4193d34

Co-authored-by: NodeX-AR <181326897+NodeX-AR@users.noreply.github.com>

Copilot AI review requested due to automatic review settings September 7, 2026 14:49

Copilot AI reviewed Sep 7, 2026

vercel Bot had a problem deploying to Preview September 7, 2026 14:49 Failure

Copilot finished work on behalf of NodeX-AR September 7, 2026 14:49

		<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js" integrity="sha512-D9gUyxqja7hBtkWpPWGt9wfbfaMGVt9gnyCvYa+jojwwPHLCzUm5i8rpk7vD7wNee9bA35eYIjobYPaQuKS1MQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
		<script src="https://cdnjs.cloudflare.com/ajax/libs/marked/12.0.0/marked.min.js"></script>

		<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/github-dark.min.css" integrity="sha512-rO+olRTkcf304DQBxSWxln8JXCzTHlKnIdnMUwYvQa9/Jd4cQaNkItIUj6Z4nvW1dqK0SKXLbn9h4KwZTNtAyw==" crossorigin="anonymous" referrerpolicy="no-referrer" />
		<script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js" integrity="sha512-D9gUyxqja7hBtkWpPWGt9wfbfaMGVt9gnyCvYa+jojwwPHLCzUm5i8rpk7vD7wNee9bA35eYIjobYPaQuKS1MQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

Conversation

Copilot AI commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

NodeX-AR commented Sep 7, 2026

Uh oh!

Copilot AI commented Sep 7, 2026

Uh oh!

NodeX-AR commented Sep 7, 2026

Uh oh!

Copilot AI commented Sep 7, 2026

Uh oh!

NodeX-AR commented Sep 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI commented Sep 7, 2026

Uh oh!

NodeX-AR commented Sep 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Suppressed comments (1)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Sep 7, 2026

Uh oh!

NodeX-AR commented Sep 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Sep 7, 2026 •

edited

Loading

vercel Bot commented Sep 7, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Sep 7, 2026 •

edited

Loading