Skip to content

test(extension-id-guard): allow CWS URL matches; mirrors main PR #26263 #26270

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
siddseethepalli merged 1 commit into from
Apr 17, 2026
Merged

test(extension-id-guard): allow CWS URL matches; mirrors main PR #26263 #26270

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 20 additions & 5 deletions assistant/src/__tests__/extension-id-sync-guard.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,7 @@ function listTextFilesRecursively(root: string): string[] {
".turbo",
".idea",
".vscode",
".codex-worktrees",
]);

const allowedExtensions = new Set([
Expand Down Expand Up @@ -196,12 +197,20 @@ describe("Chrome extension allowlist guard", () => {
expect(new Set(ALLOWED_EXTENSION_ORIGINS)).toEqual(expectedOrigins);
});

test("concrete extension IDs appear only in canonical config", () => {
test("concrete extension IDs appear only in canonical config or CWS URLs", () => {
// The canonical extension ID may also appear in Chrome Web Store URLs
// (e.g. chromewebstore.google.com/detail/.../ID) or in documentation
// referencing the published extension. Those are acceptable — they
// reference the published extension, not duplicate config. We flag
// files where the ID appears outside of a CWS URL context.
const config = parseCanonicalConfig();
const allFiles = listTextFilesRecursively(repoRoot);

const CWS_URL_PATTERN =
/chromewebstore\.google\.com\/detail\/[^/]+\/[a-p]{32}/;

@chatgpt-codex-connector chatgpt-codex-connector Bot Apr 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Make CWS URL stripping remove every match

The new guard intends to allow extension IDs when they only appear inside Chrome Web Store URLs, but content.replace(CWS_URL_PATTERN, "") uses a non-global regex, so only the first matching URL in a file is removed. If a file contains the same extension ID in multiple CWS links, later occurrences remain and stripped.includes(extensionId) incorrectly flags the file as a violation, causing false CI failures in exactly the scenario this change is trying to permit.

Useful? React with 👍 / 👎.

Comment on lines +209 to +210

@devin-ai-integration devin-ai-integration Bot Apr 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Missing g flag on CWS_URL_PATTERN causes only the first CWS URL per file to be stripped

String.prototype.replace() with a non-global regex only replaces the first match. If a file contains the canonical extension ID in two or more Chrome Web Store URLs (e.g., a README that links to the extension in two places), only the first CWS URL is stripped from content. The extension ID from subsequent CWS URLs survives into stripped, so stripped.includes(extensionId) returns true and the guard incorrectly flags the file as an unexpected match.

Reproduction with two CWS links in one file

Given content like:
link1: https://chromewebstore.google.com/detail/ext/ID and link2: https://chromewebstore.google.com/detail/ext/ID

After content.replace(CWS_URL_PATTERN, ""), the result is:
link1: https:// and link2: https://chromewebstore.google.com/detail/ext/ID

The ID is still present, causing a false positive. With the g flag both URLs are stripped and the check passes correctly.

Suggested change
const CWS_URL_PATTERN =
/chromewebstore\.google\.com\/detail\/[^/]+\/[a-p]{32}/;
const CWS_URL_PATTERN =
/chromewebstore\.google\.com\/detail\/[^/]+\/[a-p]{32}/g;
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.


for (const extensionId of config.allowedExtensionIds) {
const matches: string[] = [];
const unexpectedMatches: string[] = [];
for (const absPath of allFiles) {
const relPath = absPath.replace(`${repoRoot}/`, "");
let content: string;
Expand All @@ -212,11 +221,17 @@ describe("Chrome extension allowlist guard", () => {
if ((err as NodeJS.ErrnoException).code === "ENOENT") continue;
throw err;
}
if (content.includes(extensionId)) {
matches.push(relPath);
if (!content.includes(extensionId)) continue;
if (relPath === CANONICAL_CONFIG_REL_PATH) continue;

// Strip all CWS URLs and check if the ID still appears — if it
// does, the file is using the ID as a standalone config value.
const stripped = content.replace(CWS_URL_PATTERN, "");
if (stripped.includes(extensionId)) {
unexpectedMatches.push(relPath);
}
}
expect(matches).toEqual([CANONICAL_CONFIG_REL_PATH]);
expect(unexpectedMatches).toEqual([]);
}
});
});
Loading