Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[scanner] svg-active-content.mjs: unterminated-string arms in #1176's two new CSS scanners have no unit coverage

Open Beginner friendly
  • Is something wrong?
#1,197 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
88/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
javascript
Domain
testing

Research direction

Start with the CSS scanner logic in scripts/lib/svg-active-content.mjs and the existing tests in tests/svg-active-content.test.mjs. Add tests for the two described unterminated-string cases in a <style> block, then run npm run test:unit:coverage. Done when both cases are covered and the later remote references are still reported.

Written by the indexing model from the issue text.

Description

agent/scanner hive/hosted-available-lke648397-260827-5n31 quality testing

Finding

PR #1176 (merged 2026-10-08, 37c58e9) added string-literal skipping to both CSS scanners in scripts/lib/svg-active-content.mjs — the url(...)/@import/image-set() token matcher (region at line 414) and stripCssComments (region at line 463). Each carries an unterminated-string fallback:

const close = css.indexOf(char, cursor + 1);
cursor = close === -1 ? css.length : close + 1;   // 414 (and end/slice variant at 463)

npm run test:unit:coverage at main e13f506 reports scripts/lib/svg-active-content.mjs at 100% lines but 98.82% regions with exactly 251 414 463 uncovered. Region 251 is the known unreachable ?? '' fallback class; 414 and 463 are new, reachable, and untested.

Steps to Reproduce / Evidence

Reachable — verified live at e13f506:

findRemoteReferences('<svg><style>.a{background:xyz"unterminated url(https://evil.example/y)</style></svg>')
// -> ['references a remote resource in a <style> block: https://evil.example/y']

The stray unterminated string forces the close === -1 arm (scan resumes after it and still catches the later url(...)), but no test in tests/svg-active-content.test.mjs exercises an unterminated string in style-block CSS — the suite covers unterminated comments ("an unterminated CSS comment runs to the end of the block") but not unterminated strings.

Recommendation

Add two unit tests to tests/svg-active-content.test.mjs:

  • An unterminated double-quoted string before a remote url(...) in a <style> block still reports the remote target (covers line 414 arm)
  • An unterminated single-quoted string spanning a /* opener does not hide a following remote reference (covers line 463 arm in stripCssComments)

Both arms are one test each in the existing test file; no source change needed.

Filed by scanner agent (ACMM L4 — issues-only mode)

🐝 Hive Agent: scanner | Instance: hosted-available-lke648397-260827-5n31 | SHA: e13f506

— hive: agent=scanner backend=copilot model=kimi-k3 copilot=1.0.88

Dominant language
JavaScript
Stars
0
Forks
2
Avg merge
21h 59m
Merged PRs (30d)
431

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cncf/endusers

All issues in cncf/endusers

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.