mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-05 23:02:10 +03:00
0056dbc3b5
CodeQL flagged bin/aliasResolver.mjs for building a `data:text/javascript,...` URL dynamically via `new URL()` to register the ESM loader hook — flagged as js/incomplete-url-substring-sanitization. Refactor: extract the hook source into a real file `bin/aliasResolverHook.mjs` and load it via `pathToFileURL()` from `node:url` instead of the inline data-URL approach. The hook behaviour is unchanged (still resolves `@/<path>` specifiers relative to the repo root passed via the register `data` option). Supporting changes so CI stays green: - pack-artifact-policy.ts: add bin/aliasResolver.mjs and bin/aliasResolverHook.mjs to both ALLOWED_EXACT_PATHS (tarball ship) and REQUIRED_PATHS (regression guard — absence now fails loudly). - tests/unit/pack-artifact-policy.test.ts: update the findMissingArtifactPaths snapshot expectation. - config/quality/quality-baseline.json: rebaseline bundleSize 6534 -> 6762 (+228). The hook file is now a 5th bin/*.mjs entrypoint counted by size-limit; the bytes were previously hidden inside aliasResolver.mjs because the template literal was compressed away.