Repository navigation
fix(web): resolve 2xl layout, section sorting, security hardening, and bundle footprint - #276
Merged
Merged
Conversation
…d bundle footprint - Fix 2xl viewport layout distortion in BaseLayout.astro by anchoring footer as a full-width bottom child - Resolve section sorting bug (parseFloat evaluating Title 42 Section 2000e-1 in scientific notation) with compareSectionNumbers - Harden CSP with base-uri, object-src, and form-action directives - Replace chapter full-text innerHTML DOM assignment with document.adoptNode - Add --color-amber dark mode token (#FFBE2E) for WCAG AA contrast on navy - Decouple sanitizeExcerpt into sanitize.ts to prevent bundling Octokit on every page - Add OptionalHttpUrlSchema to avoid crashing on empty or unpinned CourtListener source URLs - Cap MAX_DECOMPRESSED_BYTES to 500 MiB within V8 MAX_STRING_LENGTH - Add randomized jitter to retry exponential backoff - Exclude src/__tests__ from tsconfig.build.json across packages to speed up Vitest
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…ath citation regex
| const match = /^(\d+[a-zA-Z]?)\s+U\.S\.C\.\s+(\d+[a-zA-Z-]*)$/.exec(section); | ||
| // Pre-normalize section symbols and collapse multiple whitespace runs | ||
| // to avoid polynomial catastrophic backtracking (ReDoS) on untrusted input | ||
| const normalized = section.replace(/[§\u00A7]|§/g, ' ').trim().replace(/\s+/g, ' '); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR addresses P0 and P1 review findings across QA, Legal Accuracy, Security, and Code Optimization audits.
1. QA & UX Readability Enhancements
<footer>remains a full-width bottom child across all responsive viewports, resolving the issue where viewports>= 1536pxrendered the footer as a vertical column beside the article.try/catchguards aroundlocalStorageaccess in ReadingToolbar.svelte, scoped the class mutator to statutory content, and boosted label contrast (text-slate dark:text-gray-300) to achieve WCAG AA contrast.--color-amber: #FFBE2Ein dark mode inside global.css for >8:1 contrast on deep navy.@@ -x,y +x,y @@hunk markers and leading context spaces in github.ts.SELECTelements andisContentEditablein thej/kkeyboard navigation listener.2. Legal Accuracy
parseFloatSection Sorting Bug: JavaScript'sparseFloat('2000e-1')evaluates hyphens as scientific notation (200), corrupting the order of Title 42 Civil Rights sections and sections with letter suffixes (e.g.101a). Implemented and exported compareSectionNumbers in@civic-source/shared, backed by comprehensive test coverage, and adopted it across the web app.§and whitespace so citations like18 U.S.C. § 111resolve to canonical paths.renumberedstatutes in SummaryBox.astro to prevent false 'In Force' badges.3. Security Hardening
base-uri 'self'; object-src 'none'; form-action 'self';to BaseLayout.astro.wrapper.innerHTML = prose.innerHTMLin chapter.astro withdocument.adoptNode.OptionalHttpUrlSchemain@civic-source/typesso off-origin CourtListener URLs falling back to''do not abort the annotation pipeline.MAX_DECOMPRESSED_BYTESin@civic-source/fetcherto 500 MiB to strictly remain within V8MAX_STRING_LENGTH(~512 MB).@civic-source/sharedto mitigate thundering herds.4. Performance & Bundle Footprint
sanitizeExcerptinto sanitize.ts, preventingSearchBar.sveltefrom importing@octokit/restand cutting ~255 KB of unnecessary JavaScript from every page load.src/__tests__intsconfig.build.jsonacross packages, halving Vitest execution time by preventing redundant double runs ondist/.Verification
pnpm -r testpassed 100% across all 6 packages.pnpm -r typecheckpassed with 0 errors across 20 files.pnpm run lintpassed across all packages.pnpm buildsucceeded cleanly.pnpm auditreports 0 known vulnerabilities.