diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml new file mode 100644 index 0000000..c6af081 --- /dev/null +++ b/.github/codeql/codeql-config.yml @@ -0,0 +1,7 @@ +name: CodeQL config + +# The H5P core as h5p-php-library has it, at the commit vendor/h5p-core/SOURCE.json names, and +# not changed here: a finding in it is upstream's, reported there and taken with `pnpm core:sync`. +# Until #37 the same code came from h5p-standalone under node_modules/, which was not scanned either. +paths-ignore: + - packages/runtime/vendor diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e5d8cb5..cce1f01 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -25,4 +25,5 @@ jobs: with: languages: javascript-typescript build-mode: none + config-file: ./.github/codeql/codeql-config.yml - uses: github/codeql-action/analyze@v4 diff --git a/AGENTS.md b/AGENTS.md index 360b967..a7c6638 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -68,6 +68,8 @@ packages/player/ @missing-elements/h5p-offline-player — the published package-reader.ts zip index + per-entry serving strategy pack-plan.ts which parts of the pack a package needs, and which of its own folders they replace (`planPack`): pure, unit-tested in tests/unit/pack-plan.test.ts + library-load.ts what a frame loads, its libraries' scripts and styles in order (`LibraryLoad`), + which the `boot` route answers: h5p-standalone's walk and sort, ported (#37) frame-document.ts the frame HTML the worker synthesizes, and its CSP; it names the runtime's frame-boot.js with `\n` : '' + const legacyLoader = loader ? `\n` : '' // The last rule in the style block is for H5P.Video's YouTube handler, which pins its iframe // over the 16:9 box it builds with one line that reaches into the YouTube API object's minified @@ -416,8 +426,7 @@ ${fontFaces}
- -${strings} +${legacyLoader}${strings}