refactor(security): drop dead escapeHtml re-export from html-sanitizer - #3288
Merged
Conversation
The html-sanitizer module re-exported escapeHtml purely as a pass-through from #veryfront/utils/html-escape.ts. No importer of html-sanitizer consumes it, the security barrel does not re-export the module, and security/client/html-sanitizer.ts is not in the deno.json exports map, so the alias was unreachable public surface. Every escapeHtml consumer already imports from the html-escape modules directly.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Contributor
There was a problem hiding this comment.
Pull request overview
Removes a verified-dead escapeHtml re-export from the client HTML sanitizer module, keeping the security surface focused on the intended sanitizer APIs and avoiding unused compatibility exports.
Changes:
- Drop the
escapeHtmlimport and re-export fromsrc/security/client/html-sanitizer.ts.
Verification
- Not run in this review environment.
- PR description reports:
deno checkclean on 12 sanitizer importers;src/security/tests 78 passed;src/html/tests 40 passed.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Minimal remainder of a planned security port: the CSRF and inline-script hardening scoped for this slice already landed on main via #3254 (verified byte-identical to the source branch). What remains is a verified-dead re-export: no consumer imports
escapeHtmlfrom the sanitizer (all ~20 call sites import the html-escape utils directly), the module is not re-exported bysrc/security/index.ts, and no export map or surface test reaches it.Verification
deno checkclean on all 12 sanitizer importers;src/security/78 passed (970 steps) / 0 failed;src/html/40 passed (671 steps) / 0 failed.test:unitin 4 unrelated react files — fix incoming asfix/react-test-gate.